Omnium Hub CRM

Manage Omnium Hub CRM (contacts, opportunities, appointments). Use for all CRM-related tasks.

Security Scan

The skill mostly does what its README describes (a CLI that calls a CRM HTTP API) but there are inconsistencies (branding vs. target domain, undeclared secret handling, and examples that leak API keys on the command line) that merit caution before installing or using it.

Purpose & Capability

The skill claims to manage 'Omnium Hub' CRM and includes a Python client that performs contact and opportunity operations — functionally consistent with the description. However the client targets BASE_URL = "https://services.leadconnectorhq.com" (LeadConnector domain), which does not match the 'Omnium Hub' name; this branding/domain mismatch is unexplained and should be verified (could be a legitimate integration or a mislabel).

Instruction Scope

SKILL.md confines the agent to calling the included script and asking the user for an API key. It does not instruct reading arbitrary files or other system credentials. However the examples and usage show passing the API key on the command line (--api-key "...") which exposes the secret to process listings/shell history and agent logs; the script prints raw JSON responses (which may contain PII or sensitive CRM data) to stdout. These are scope/privacy concerns but not evidence of unrelated behavior.

Install Mechanism

No install spec (instruction-only with an included Python script). Nothing is downloaded or written during installation. The only runtime dependency is the Python 'requests' library, which is expected for a small HTTP client; lack of an explicit install step means the environment must already provide required runtime packages.

Credentials

The skill requires an Omnium Hub API Key at runtime (SKILL.md explicitly asks the agent to prompt for it) — this is proportional to a CRM client. However the registry metadata lists no required env vars or primary credential, so the need for a secret is not declared in metadata. Also examples encourage passing the key via the command line which is insecure. No other unrelated credentials or config paths are requested.

Persistence & Privilege

The skill is not always-enabled and does not request persistent system-wide configuration or modify other skills. It does allow autonomous invocation (platform default) but that alone is not a red flag here; nothing in the code attempts to persist credentials or escalate privileges.

What to consider before installing

This skill appears to be a simple Python CLI for a CRM API, but verify the endpoint before providing credentials: the included code calls services.leadconnectorhq.com while the skill calls itself 'Omnium Hub' — confirm that domain is the legitimate API for your Omnium Hub account. Do not paste your full production API key into command lines or chat messages (the examples show --api-key which exposes it to process lists and history). Prefer using a short-lived or scoped API key, storing it in the agent's secret manager or an environment variable (and modify the script to read from an env var or secure stdin) rather than including it on the command line. Be aware the script prints full JSON responses (which can contain PII) to stdout — review logs/agent audit trails if you run it. If you are unsure about the service mapping (Omnium Hub vs LeadConnector), ask the publisher for clarification or test with a low-privilege/test account first.

Omnium Hub Skill

This skill allows you to interact with the Omnium Hub CRM.

Prerequisites

To use this skill, you need an Omnium Hub API Key.

• If you do not have an API key, ask the user for it: "Please provide your Omnium Hub API Key to proceed."
• Once provided, use it in the scripts below.

Tools

1. Manage Contacts

Use scripts/omnium_client.py to manage contacts.

Usage:

python3 scripts/omnium_client.py --api-key "YOUR_KEY" contacts --action [lookup|create|update] --email "[e-mail]" [other options]

Actions:

• lookup: Find a contact by email or phone.
• create: Create a new contact.
• update: Update an existing contact.

Examples:

• "Find the contact for [e-mail] in Omnium Hub." -> python3 scripts/omnium_client.py --api-key "..." contacts --action lookup --email "[e-mail]"

• "Add Jane Doe ([e-mail]) to Omnium Hub." -> python3 scripts/omnium_client.py --api-key "..." contacts --action create --first-name "Jane" --last-name "Doe" --email "[e-mail]"

2. Manage Opportunities

Use scripts/omnium_client.py with the opportunities command.

Usage:

python3 scripts/omnium_client.py --api-key "YOUR_KEY" opportunities --action list --pipeline-id "..."

Troubleshooting

• 401 Unauthorized: The API Key is invalid. Ask the user to check their Omnium Hub credentials.
• 404 Not Found: The contact or resource does not exist.