T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:35- Finding
Plaintext CRM Data May Be Exposed Through Git Repository Storage
- Content
View full analysis
- Remediation
View remediation
Security audit
CRM-in-a-Box
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent file-based CRM skill, but it needs Review because it encourages storing customer data in plaintext, append-only git-style files without clear privacy, access-control, or deletion guidance.
Install only if you are prepared to treat the CRM directory as sensitive business data: keep it private, avoid public or broadly shared repositories, use restrictive filesystem permissions and encrypted storage/backups, and define how corrections, redactions, and deletion requests will be handled despite append-only history.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README encourages use of a git-repo-based CRM for contacts, pipeline, and interactions, which commonly contain personal data, business-sensitive notes, and communications metadata, but it provides no warning about privacy, access control, encryption, or safe repository handling. In this skill context, that omission is more dangerous because users may treat the repository model as safe by default and accidentally commit sensitive CRM data to shared, unencrypted, or public locations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly promotes storing contacts, pipeline, and interaction data in local flat files, which will often contain personal and commercially sensitive information. Without any warning about confidentiality, file permissions, encryption, backup exposure, or retention, users may unknowingly create unprotected on-disk data stores that are easy to copy, sync, or leak.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The agent instructions direct users to append and update CRM records in local NDJSON files but do not warn that these operations modify persistent local state and may be hard to undo because the design is append-only. In a CRM context, this can cause accidental retention of incorrect, duplicated, or sensitive records and increases the risk of unauthorized disclosure through local files and shell history.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The HTML root element sets
lang="en", which establishes English as the page language with no indication of user opt-in or alternative locale support. Under the policy, forcing a specific language without choice or justification is a natural-language policy concern.- Content
Static analysis
No suspicious patterns detected.