Omnium Hub CRM

Manage Omnium Hub CRM (contacts, opportunities, appointments). Use for all CRM-related tasks.

This skill appears to be a simple Python CLI for a CRM API, but verify the endpoint before providing credentials: the included code calls services.leadconnectorhq.com while the skill calls itself 'Omnium Hub' — confirm that domain is the legitimate API for your Omnium Hub account. Do not paste your full production API key into command lines or chat messages (the examples show --api-key which exposes it to process lists and history). Prefer using a short-lived or scoped API key, storing it in the agent's secret manager or an environment variable (and modify the script to read from an env var or secure stdin) rather than including it on the command line. Be aware the script prints full JSON responses (which can contain PII) to stdout — review logs/agent audit trails if you run it. If you are unsure about the service mapping (Omnium Hub vs LeadConnector), ask the publisher for clarification or test with a low-privilege/test account first.

Type: OpenClaw Skill Name: omnium-hub-crm Version: 1.0.0 The skill is designed for legitimate CRM interaction, but it handles the Omnium Hub API Key in a vulnerable manner. The `SKILL.md` instructs the AI agent to pass the API key directly as a command-line argument to `scripts/omnium_client.py`. This practice exposes the sensitive API key in process lists, shell history, and agent logs, which is a significant information exposure vulnerability, classifying it as suspicious rather than benign. There is no evidence of malicious intent such as data exfiltration to unauthorized endpoints, persistence mechanisms, or prompt injection attempts against the agent.