ClawHub
Back to skill

Security audit

雄韬CRM - opencrm

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed CRM integration that can create and edit live CRM records through the stated XTOCN API.

Install this only if you intend your agent to use an OPENCRM_KEY to access the XTOCN CRM API. Before asking it to add or edit records, verify the target company and fields, because successful write calls can change live business data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill enables creation and modification of live CRM records but does not prominently warn users that actions affect production customer data and may create or alter records irreversibly. In a CRM context, missing this warning increases the chance of unintended writes, data corruption, and operational mistakes by users who may assume the tool is read-only or sandboxed.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill sends user-provided company text and CRM data to an external API endpoint at my.xtocn.com, but it does not clearly disclose this data transmission risk to the user. This is dangerous because users may paste sensitive business information, contact details, or proprietary lead data without understanding it will be transmitted off-platform to a remote third-party service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.