sharecrm
Pass
Audited by Gen Agent Trust Hub on May 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install Node.js from the NodeSource distribution service and the sharecrm CLI from the official NPM registry. These are established and well-known technology services.\n- [REMOTE_CODE_EXECUTION]: Installation steps for Linux involve piping a remote script from NodeSource directly to a shell (curl | bash). This is a standard installation method for Node.js provided by a well-known service.\n- [COMMAND_EXECUTION]: The skill primary function is executed via the sharecrm command-line interface. It uses this tool to manage CRM objects, authentication, and system configuration.\n- [DATA_EXFILTRATION]: The skill provides an interface for interacting with sensitive CRM data like customers, leads, and opportunities. This is the intended primary purpose of the skill. Boundary markers are partially maintained by using structured JSON as the transport format for CLI arguments.\n
- Ingestion points: CRM data is ingested via the QueryRecords and QueryRecordsWithAggregate commands described in references/products/data.md.\n
- Boundary markers: The skill instructs the agent to wrap user input and retrieved data within JSON strings passed to the CLI.\n
- Capability inventory: The agent can read, create, and search CRM data using the sharecrm binary.\n
- Sanitization: No explicit sanitization logic is provided in the skill instructions beyond relying on the CLI's parsing of JSON.
Audit Metadata