跳转到正文
skillsafebeta
← 报告库
用途分类 / 数据分析

Revops Skill 安全审计

作者说它能做什么（原文）

When the user wants help with revenue operations, lead lifecycle management, or marketing-to-sales handoff processes. Also use when the user mentions 'RevOps,' 'revenue operations,' 'lead scoring,' 'lead routing,' 'MQL,' 'SQL,' 'pipeline stages,' 'deal desk,' 'CRM automation,' 'marketing-to-sales handoff,' 'data hygiene,' 'leads aren't getting to sales,' 'pipeline management,' 'lead qualification,

第三方安全检查结论

发现安全风险

已检查文件
6
发现的风险
5
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 2 项风险
中风险

默认读取产品营销文件可能把机密业务背景带入 AI 上下文

原文依据：1 处
发现了什么

Skill 要求在提问前自动读取多个约定位置的产品营销文件，而不是先取得本次任务所需范围的确认。这些文件可能包含定位、客户、定价或上市策略。

为什么需要注意

如果代理能访问这些文件，其内容可能进入模型上下文、日志或后续生成的文档，即使当前 RevOps 问题并不需要全部资料。源码未显示网络外传，但扩大了敏感资料的暴露面。

这是实时的 Skill 指令：只要约定文件存在，AI 就会在提问前读取它。文件内容因此会进入模型上下文，即使用户本次只需要局部 RevOps 建议。源码未要求先确认读取范围或排除敏感字段。风险取决于这些文件实际包含什么以及所用 AI 服务的数据处理方式；并不证明资料已被外传。用户可要求作者改为先征得同意、只读取任务必需部分并明确数据保留边界。

SKILL.md:14来自说明文档打开原文件
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
中风险

配方会把潜在客户资料发送到 Slack、数据增强商和广告受众

原文依据：4 处
发现了什么

跨工具流程要求用 Clearbit 增强联系人后，把增强资料发布到 Slack；另一流程将达到评分阈值的联系人加入 Facebook 或 Google Ads 重定向受众。没有要求先检查同意、数据最小化或渠道访问范围。

为什么需要注意

实施后，联系人身份、行为及推断出的商业兴趣会传播给更多员工和第三方平台，可能造成隐私、合同、广告合规或账号治理风险。

这些是配置配方，并不会仅因安装 Skill 而执行；但若用户照做，联系人会被 Clearbit 增强，增强后的资料会发布到 Slack，达到阈值的联系人还会进入 Facebook/Google Ads 受众。源码没有在这些步骤中要求核验同意、字段最小化、保留期限或 Slack/广告账户的访问范围，因此存在向额外服务披露潜客资料的风险。用户可要求作者列出传输字段、处理方和同意/退出检查。

references/automation-playbooks.md:239来自说明文档打开原文件
**Trigger:** New form submission (Typeform, HubSpot, Webflow)**Actions:**1. Create/update contact in CRM2. Enrich with Clearbit (if available)3. Post to Slack #new-leads with enriched data4. Create task in project management tool (Asana, Linear)
查看另外 3 个位置
references/automation-playbooks.md:267来自说明文档打开原文件
**Trigger:** CRM lead score crosses MQL threshold**Actions:**1. Update marketing automation platform status2. Add to retargeting audience (Facebook, Google Ads)3. Trigger SDR outreach sequence4. Log event in analytics (Mixpanel, Amplitude)
references/automation-playbooks.md:237来自说明文档打开原文件
### 1. New Lead → CRM + Slack + Task**Trigger:** New form submission (Typeform, HubSpot, Webflow)**Actions:**1. Create/update contact in CRM2. Enrich with Clearbit (if available)3. Post to Slack #new-leads with enriched data4. Create task in project management tool (Asana, Linear)
references/automation-playbooks.md:265来自说明文档打开原文件
### 4. Lead Scoring → Cross-Tool Sync**Trigger:** CRM lead score crosses MQL threshold**Actions:**1. Update marketing automation platform status2. Add to retargeting audience (Facebook, Google Ads)3. Trigger SDR outreach sequence4. Log event in analytics (Mixpanel, Amplitude)
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。发现 1 项风险
中风险

自动去重、合并和归档可能造成持久的 CRM 数据丢失

原文依据：5 处
发现了什么

Skill 建议每周自动去重，并用“CRM 记录优先、最近活动优先”的通用规则决定字段；还建议归档 12 个月无活动的联系人。这些规则没有要求完整备份、逐字段冲突审查或恢复测试。

为什么需要注意

误匹配可能把不同联系人合并，较新的错误值可能覆盖正确资料；归档也可能隐藏仍受合同、支持、续约或法定留存要求约束的记录。

Skill 明确建议每周自动去重，并用通用优先规则解决字段冲突；还建议归档长期无活动联系人。若直接实施，合并可能覆盖较旧但正确的字段，归档可能使仍有价值的联系人退出日常流程。风险比候选标题所称的“数据丢失”更有限：源码要求边缘情况人工复核，而且“归档”不等于删除；但没有可见的备份、完整冲突审查或恢复验证要求。用户可要求只生成候选清单、保留合并前快照并测试恢复。

SKILL.md:243来自说明文档打开原文件
- **Matching rules** — Email domain + company name + phone as primary match keys- **Merge priority** — CRM record wins over marketing automation; most recent activity wins for fields- **Scheduled dedup** — Run weekly automated dedup with manual review for edge cases
查看另外 4 个位置
SKILL.md:263来自说明文档打开原文件
- Review and merge duplicates- Validate email deliverability on stale contacts- Archive contacts with no activity in 12+ months- Audit lifecycle stage distribution (look for bottlenecks)
references/routing-rules.md:134来自说明文档打开原文件
2. **Assign account owners** in CRM (1 rep per account)3. **Match logic:** Any lead from a target account domain routes to account owner4. **Matching rules:**   - Email domain match (primary)   - Company name fuzzy match (secondary, requires manual review)   - IP-to-company resolution (tertiary, for anonymous visitors)
SKILL.md:241来自说明文档打开原文件
### Dedup Strategy- **Matching rules** — Email domain + company name + phone as primary match keys- **Merge priority** — CRM record wins over marketing automation; most recent activity wins for fields- **Scheduled dedup** — Run weekly automated dedup with manual review for edge cases
SKILL.md:261来自说明文档打开原文件
### Quarterly Audit Checklist- Review and merge duplicates- Validate email deliverability on stale contacts- Archive contacts with no activity in 12+ months- Audit lifecycle stage distribution (look for bottlenecks)- Verify enrichment data accuracy on a sample set
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 2 项风险
中风险

评分或计时器可自动触发外联并重新分配商机负责人

原文依据：4 处
发现了什么

配方在评分达到固定阈值时自动将联系人升级、停止培育并触发销售提醒；在逾期后还会自动更换联系人负责人并创建紧急任务。负责人变更及序列触发没有人工批准步骤。

为什么需要注意

错误评分、漏记活动或时间计算问题可能让客户收到不合适的销售联系，破坏既有客户关系、归属和佣金记录，并引发重复外联。

这些是用户需要在 HubSpot 中实施的示例流程，不是 Skill 自己直接操作 CRM。实施后，65 分会自动改变生命周期阶段、暂停培育并串联到包含销售序列的提醒流程；未联系满 48 小时还会轮换负责人。源码未在这些业务状态和归属变更前设置人工审批，可能造成误外联、重复触达或错误改派。用户可要求先使用草稿/审批模式，并限制自动改派和序列注册。

references/automation-playbooks.md:24来自说明文档打开原文件
**Name:** MQL SLA Breach Alert**Trigger:** Contact property "Lifecycle Stage" equals "MQL" AND "Days since last contacted" is greater than 0.5 (12 hours)**Actions:**1. Send internal email to contact owner: "SLA warning: [Contact Name] has not been contacted"2. If still no activity after 24 hours → send alert to sales manager3. If still no activity after 48 hours → reassign contact owner via rotation4. Create task for new owner: "Urgent: Contact [Contact Name] — reassigned due to SLA breach"**Outcome:** No MQL goes unworked for more than 48 hours
查看另外 3 个位置
references/automation-playbooks.md:38来自说明文档打开原文件
**Name:** Auto-MQL on Score Threshold**Trigger:** Contact property "HubSpot Score" is greater than or equal to 65**Actions:**1. Set lifecycle stage to "Marketing Qualified Lead"2. Set "MQL Date" to current date3. Suppress from marketing nurture workflows4. Trigger MQL Alert workflow (recipe #1)**Outcome:** Leads automatically promote to MQL when they hit the scoring threshold**Notes:** Add suppression list for existing customers and competitors
references/automation-playbooks.md:14来自说明文档打开原文件
2. Send internal email notification to contact owner with lead context3. Create task: "Follow up with [Contact Name]" — due in 4 hours4. Send Slack notification to #sales-alerts channel5. Enroll in "MQL Follow-Up" sequence (if using HubSpot Sequences)**Outcome:** Every MQL gets assigned instantly with a clear SLA
references/automation-playbooks.md:9来自说明文档打开原文件
**Name:** MQL Notification and Task Creation**Trigger:** Contact property "Lifecycle Stage" is changed to "Marketing Qualified Lead"**Actions:**1. Rotate contact owner among sales team (round-robin)2. Send internal email notification to contact owner with lead context3. Create task: "Follow up with [Contact Name]" — due in 4 hours4. Send Slack notification to #sales-alerts channel5. Enroll in "MQL Follow-Up" sequence (if using HubSpot Sequences)**Outcome:** Every MQL gets assigned instantly with a clear SLA**Notes:** Set enrollment criteria to exclude leads already owned by a rep
低风险

通用负向评分可能错误地排除合法潜在客户

原文依据：3 处
发现了什么

模板对竞争对手域名、教育邮箱、个人邮箱以及学生、实习生和顾问职称统一扣分，并可据此自动触发或阻止销售流程。这些代理指标未必反映真实购买权限或合法资格。

为什么需要注意

实施不当可能降低特定群体获得销售回应的机会，漏掉有效商机，并使商业决策难以解释；在部分地区或行业还可能引起公平性或政策审查。

模板确实会依据域名、邮箱类型和职称扣分，而自动化示例会在总分达到 65 时改变状态并启动销售流程；因此这些代理指标可能让合法潜客延迟或无法达到阈值。不过候选描述忽略了模板中的缓解说明：竞争对手域名是“标记复核”，教育邮箱注明可能有效，个人邮箱注明应按 SMB 调整。风险主要出现在把模板原样自动化时。用户可要求基于历史结果验证权重、人工复核负分记录并允许例外。

references/scoring-models.md:107来自说明文档打开原文件
| Signal | Points | Notes ||--------|--------|-------|| **Competitor email domain** | -50 | Auto-flag for review || **Student email (.edu)** | -30 | May still be valid in some cases || **Personal email (gmail, yahoo)** | -10 | Less relevant for B2B; adjust for SMB || **Unsubscribe from emails** | -20 | Reduce engagement score || **Bounce (hard)** | -50 | Remove from scoring || **Spam complaint** | -100 | Remove from all sequences || **Job title: Student/Intern** | -25 | Low buying authority || **Job title: Consultant** | -10 | May be evaluating for client || **No website visit in 90 days** | -15 | Score decay |
查看另外 2 个位置
references/scoring-models.md:105来自说明文档打开原文件
## Negative Scoring Signals| Signal | Points | Notes ||--------|--------|-------|| **Competitor email domain** | -50 | Auto-flag for review || **Student email (.edu)** | -30 | May still be valid in some cases || **Personal email (gmail, yahoo)** | -10 | Less relevant for B2B; adjust for SMB || **Unsubscribe from emails** | -20 | Reduce engagement score || **Bounce (hard)** | -50 | Remove from scoring || **Spam complaint** | -100 | Remove from all sequences || **Job title: Student/Intern** | -25 | Low buying authority || **Job title: Consultant** | -10 | May be evaluating for client || **No website visit in 90 days** | -15 | Score decay || **Invalid phone number** | -10 | Data quality signal || **Careers page visitor only** | -30 | Likely a job seeker |
references/automation-playbooks.md:38来自说明文档打开原文件
**Name:** Auto-MQL on Score Threshold**Trigger:** Contact property "HubSpot Score" is greater than or equal to 65**Actions:**1. Set lifecycle stage to "Marketing Qualified Lead"2. Set "MQL Date" to current date3. Suppress from marketing nurture workflows4. Trigger MQL Alert workflow (recipe #1)**Outcome:** Leads automatically promote to MQL when they hit the scoring threshold**Notes:** Add suppression list for existing customers and competitors

Skill 逻辑拆解

8 个说明模块

该 Skill 是 RevOps 建议与配置模板，要求产出生命周期、评分、路由、管道和指标文档；所提供源码中没有可执行脚本或安装命令。实际风险主要在于用户或代理把这些配方实施到 CRM、Slack、广告及邮件系统后产生的动作。

查看原文
SKILL.md:297来自说明文档打开原文件
When delivering RevOps recommendations, provide:1. **Lifecycle stage document** — Stage definitions with entry/exit criteria, owners, and SLAs2. **Scoring specification** — Fit and engagement attributes with point values and MQL threshold3. **Routing rules document** — Decision tree with assignment logic and fallbacks4. **Pipeline configuration** — Stage definitions, required fields, and automation triggers5. **Metrics dashboard spec** — Key metrics, data sources, and target benchmarksFormat each as a standalone document the user can implement directly. Include platform-specific guidance when the CRM is known.

它会先查找并读取项目中的产品营销背景文件，再决定询问哪些信息。这会扩大每次 RevOps 请求默认读取的本地业务资料范围。

查看原文
SKILL.md:14来自说明文档打开原文件
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

自动化配方不仅生成建议，还描述了会更改联系人负责人、生命周期阶段、任务、邮件序列和外部通知的实施动作。因此，授予 CRM 或通信工具写权限后，其影响可能超出只读分析。

查看原文
references/automation-playbooks.md:10来自说明文档打开原文件
**Name:** MQL Notification and Task Creation**Trigger:** Contact property "Lifecycle Stage" is changed to "Marketing Qualified Lead"**Actions:**1. Rotate contact owner among sales team (round-robin)2. Send internal email notification to contact owner with lead context3. Create task: "Follow up with [Contact Name]" — due in 4 hours4. Send Slack notification to #sales-alerts channel5. Enroll in "MQL Follow-Up" sequence (if using HubSpot Sequences)**Outcome:** Every MQL gets assigned instantly with a clear SLA**Notes:** Set enrollment criteria to exclude leads already owned by a rep
从这里开始 · 工作说明SKILL.md
revops
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 6 个章节，可在原文件中查看。

文件引用关系图

4 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录6 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • references/automation-playbooks.md已纳入全文
  • references/lifecycle-definitions.md已纳入全文
  • references/routing-rules.md已纳入全文
  • references/scoring-models.md已纳入全文
  • evals/evals.json已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • evals/evals.json配套文件
  • references/automation-playbooks.md配套文件
  • references/lifecycle-definitions.md配套文件
  • references/routing-rules.md配套文件
  • references/scoring-models.md配套文件
读取了多少行
1,460
文件校验值（用于核对版本）
1b7f75ff97c9823997fb562ae425b6ebec3f76a3d9475f2a3cf71262f8f7eea4