Salesflare CRM

Full Salesflare API operations skill for reading, searching, creating, and updating CRM data (accounts, contacts, opportunities, tasks, pipelines, users, tag...

This skill appears to do what it claims, but review and use caution before giving it access to real production data. Specifically: - Only provide a SALESFLARE_API_KEY you trust; the scripts will send that key to salesflare endpoints. - The smoketest/readers can perform writes or deletes only when explicit flags are passed, but double-check that any agent using this skill asks you for confirmation before executing POST/PUT/PATCH/DELETE or running smoketest with --allow-write/--allow-delete. - Be careful with --data-file / data-file-like functionality: supplying a path will read that local file and send its contents to the API — avoid pointing it at sensitive local files. - Minor env-var inconsistency: the code reads SALESFLARE_BASE_URL (documented) and also supports SALESFLARE_DEFAULT_BASE_URL internally; if you rely on custom endpoints, verify which variable to set. - If you plan to let an autonomous agent use this skill, enforce a confirmation step in the agent policy for any write/delete operations and consider testing the scripts locally first to observe behavior.

Type: OpenClaw Skill Name: salesflare Version: 1.0.7 The Salesflare skill bundle is a legitimate API integration tool for managing CRM data. It includes scripts for endpoint discovery (sf_discover.py), authenticated requests with pagination and retries (sf_request.py), and a comprehensive testing utility (sf_smoketest.py). The SKILL.md instructions explicitly enforce safety protocols, such as requiring user confirmation for all data mutations and deletions, and the code contains hardcoded safeguards against sensitive actions like deleting users. No evidence of data exfiltration, malicious execution, or prompt injection was found.