ClawHub
Back to skill

Security audit

Conversion Signal Qa

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed marketing tracking QA checklist that uses user-provided analytics exports and only saves results when the user agrees.

Before installing, expect to provide GA4 or ecommerce exports and a manual test conversion result. Review any saved memory request carefully, because the skill may persist tracking specs and unresolved signal issues for future sessions if you approve.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Save Results

After delivering, ask "Save these results for future sessions?" If yes, write the pre-flight report and the reusable UTM/event spec to `memory/ad/conversion-signal-qa/YYYY-MM-DD-<topic>.md`, promote signal-integrity blockers and the spec to `memory/hot-cache.md`, and add unresolved fixes to `memory/open-loops.md`. Do not write memory without asking.

## Reference Materials
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.