CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · skills/folk-cli/SKILL.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptskills/folk-cli/SKILL.md· markdown

127For deletes, do not pass `--yes` or `--force` unless the user explicitly asks to delete the

… (83 chars elided on L127)

128

129If the API returns 401/403, tell the user to verify or rotate `FOLK_API_KEY`. Do not ask the

… (29 chars elided on L129)

130

131## Installation hint

Occurrences

1 occurrence · at L129

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25668b030f55bcd484a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/folk-cli/SKILL.md · 1 file

skills/folk-cli/SKILL.md4.6 KB · Markdown

name: folk-cli

description: Use the folkctl CLI to inspect and update folk.app CRM data without third-party connectors. Covers people, companies, groups, deals, users, notes, reminders, interactions, and webhooks.

version: 0.1.0

license: MIT-0

metadata: {"openclaw":{"requires":{"env":["FOLK_API_KEY"],"bins":["node","folkctl"]},"install":[{"kind":"node","package":"folkctl","bins":["folkctl"]}],"primaryEnv":"FOLK_API_KEY","envVars":[{"name":"FOLK_API_KEY","required":true,"description":"folk API key used as an Authorization Bearer token."},{"name":"FOLK_API_VERSION","required":false,"description":"Optional folk API version date for X-API-Version."},{"name":"FOLK_API_BASE_URL","required":false,"description":"Optional API base URL override. Defaults to https://api.folk.app."}],"emoji":"👥","homepage":"https://github.com/j-edel/folkctl"}}

folk CLI skill

Use this skill when the user wants to work with folk.app CRM data through the first-party folk API and does not want a third-party connector.

Tooling

The CLI command is folkctl. It is designed for OpenClaw-style agent use:

--json for machine-readable output
--dry-run before mutations when you need to preview requests
--all to follow pagination
--no-input to fail instead of prompting
--yes or --force only when the user has explicitly confirmed deletion

Never print, log, or include FOLK_API_KEY in responses. Prefer environment variables over stored config in automated environments.

First checks

Run these before doing unfamiliar work:

folkctl --version
folkctl api ls
folkctl api docs people.list
folkctl people --help

When a command is missing or the schema is unclear, use the generic escape hatch:

folkctl api request GET /v1/users/me --json
folkctl api request POST /v1/people --data '{"firstName":"Ada"}' --dry-run --json

Authentication

For OpenClaw, expect FOLK_API_KEY to be set in the environment:

export FOLK_API_KEY="fk_live_..."
folkctl auth status

For local setup:

printf '%s' "$FOLK_API_KEY" | folkctl auth login --token-stdin

Common tasks

List or search people

folkctl people list --limit 20 --json
folkctl people search "Ada Lovelace" --json
folkctl people list --filter fullName:like:Ada --json

Create a person

Preview first:

folkctl people create \
  --first-name Ada \
  --last-name Lovelace \
  --email [email protected] \
  --group-id grp_123 \
  --dry-run --json

Then run without --dry-run once confirmed.

Create or update companies

folkctl companies create --name "Acme Inc" --url https://acme.example --group-id grp_123 --dry-run --json
folkctl companies update com_123 --name "Acme Corporation" --dry-run --json

Discover groups and custom fields

folkctl groups list --json
folkctl groups fields grp_123 person --json
folkctl groups fields grp_123 company --json
folkctl groups fields grp_123 Deals --json

Deals

folk deals are addressed under a group and an object type, usually the name of the deal object field, for example Deals.

folkctl deals list --group-id grp_123 --object-type Deals --json
folkctl deals create --group-id grp_123 --object-type Deals --name "Project Alpha" --company-id com_123 --person-id per_123 --custom Status=Active --dry-run --json

Notes, reminders, and interactions

folkctl notes create --entity-id per_123 --content "Met at SaaStr. Follow up next week." --visibility private --dry-run --json
folkctl reminders create --entity-id per_123 --name "Follow up" --visibility private --recurrence-rule "DTSTART;TZID=Europe/Paris:20250717T090000\nRRULE:FREQ=WEEKLY;INTERVAL=1" --dry-run --json
folkctl interactions create --entity-id per_123 --date-time 2025-07-17T09:00:00.000Z --title "Coffee" --content "Discussed the new project." --type ☕️ --dry-run --json

Webhooks

folkctl webhooks list --json
folkctl webhooks create --name "My app" --target-url https://example.com/webhook --event person.created --dry-run --json

Safety rules

Before create/update/delete commands, prefer --dry-run --json and summarize the exact resource, method, path, and body for the user.

For deletes, do not pass --yes or --force unless the user explicitly asks to delete the exact record. If the user has not confirmed, run a dry-run or ask for confirmation.

If the API returns 401/403, tell the user to verify or rotate FOLK_API_KEY. Do not ask them to paste secrets into chat.

Installation hint

If folkctl is missing, install it from npm (or from GitHub as a fallback):

npm install -g folkctl
# or: npm install -g github:j-edel/folkctl

folk-cli— agent skill

Is folk-cli safe to install?

folk CLI skill

Tooling

First checks

Authentication

Common tasks

List or search people

Create a person

Create or update companies

Discover groups and custom fields

Deals

Notes, reminders, and interactions

Webhooks

Safety rules

Installation hint

Audit the pieces. Scan the whole. Decide.