Twenty CRM

Interact with Twenty CRM (self-hosted) via REST/GraphQL.

Key points to consider before installing or using this skill: - Don’t assume the SKILL.md path is authoritative: the scripts actually try to load /Users/jhumanj/clawd/config/twenty.env. That is a hardcoded developer path and is inconsistent with SKILL.md (which says create config/twenty.env). Ask the author to fix the config path (make it relative or respect an env var) before using. - Secrets are required but not declared: the scripts need TWENTY_BASE_URL and TWENTY_API_KEY. Keep that API key secret and avoid placing it in world-readable files. Prefer exporting them as environment variables or placing the config file in a secure location you control. - Verify destination of requests: the scripts send the API key in an Authorization header to whatever TWENTY_BASE_URL you configure. Ensure that URL is your intended self-hosted instance (not a public or attacker-controlled endpoint). - Operational notes: these scripts call curl and python3 and write one temporary JSON file to /tmp. They do not install extra software or contact other domains by themselves. - Recommended actions: ask the skill author to (1) update twenty-config.sh to look for config/twenty.env (or respect an env var or relative path), (2) declare required env vars in the skill metadata, and (3) remove hardcoded user-specific paths. If you cannot get an updated version, inspect and locally modify the scripts to point to your own config path before running them. Given these coherence issues (hardcoded config path and missing declared credentials), treat the skill as suspicious until those problems are resolved.

Type: OpenClaw Skill Name: twenty-crm Version: 1.0.0 The skill is classified as suspicious primarily due to a query parameter injection vulnerability in `scripts/twenty-find-companies.sh` and `scripts/twenty-rest-get.sh`. User-provided search terms are incorporated into a URL query string without proper URL encoding, potentially allowing an attacker to inject arbitrary query parameters into the API request. Additionally, `scripts/twenty-config.sh` uses a hardcoded absolute path (`/Users/jhumanj/clawd/config/twenty.env`) for loading configuration, which is a poor practice and indicates a lack of portability or an assumption about a specific execution environment.