OEE CRM Intelligence

Two-stage intelligent filtering and scoring of CRM contacts using keywords and AI, adapting over time to prioritize leads that matter most to you.

This skill mostly does what it says (two‑stage filtering + AI scoring), but there are mismatches you should consider before installing: - The SKILL.md and crm_filter.py require ANTHROPIC_API_KEY and the 'anthropic' Python SDK, but the registry metadata did not declare any required env vars or dependencies. Treat that as an omission and verify dependencies yourself. - Stage 2 will send contact data (emails, names, sample subjects, exchange counts, timestamps, etc.) to Anthropic. If that data includes personal or confidential information, do not provide a real ANTHROPIC_API_KEY unless you accept sending that data to a third party. - The script persists learning.json (rejected_contacts and preferences) in the skill directory; review that file for sensitive content and consider where you want it stored/backed up. - The code falls back to skipping AI if the SDK or key is missing, but if you supply the key an agent or the skill can call the external API autonomously (disable-model-invocation is false). If you want to limit risk, run the script locally on sanitized/test data first or use a dedicated, limited-scope API key. What would raise or lower my concern: full, non‑truncated source (to confirm there are no hidden endpoints), explicit dependency and env var declarations in registry metadata, and a clear privacy note about what data is sent to Anthropic would reduce the ambiguity. Without those, proceed cautiously and assume the AI stage will transmit CRM data to an external service.

Type: OpenClaw Skill Name: oee-crm-intelligence Version: 1.0.0 The `crm_filter.py` script constructs a prompt for the Anthropic Claude LLM using user-provided contact data (e.g., name, subjects). This creates a prompt injection vulnerability against the LLM, where a malicious input contact could manipulate the LLM's classification or reasoning. While this is a significant vulnerability, there is no evidence of intentional malicious behavior by the skill itself, such as data exfiltration, unauthorized command execution, or persistence mechanisms beyond its stated purpose of CRM contact filtering.