Marketing Copy Knowledge

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only marketing copy skill is coherent and purpose-aligned, but users should notice that it sends prompts to an external service and includes an optional paid API-key flow.

This looks safe to install as a marketing-copy helper if you are comfortable sending non-sensitive copywriting prompts to the listed external service. Do not send secrets, private customer data, or raw payment details, and only use the paid API-key purchase flow when you explicitly intend to buy credits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the paid flow is used, the agent may handle a payment-method token and an API key, and could spend credits or money if the user authorizes it.

Why it was flagged

The skill documents an optional billing/API-key flow. This is expected for a freemium/paid service and requires operator authorization, but it still touches payment authorization and API-key handling.

Skill content
Purchase an API key (requires operator authorization and a payment method) ... "payment_method_id": "pm_xxx" ... -H "X-Api-Key: lob-<YOUR_API_KEY>"
Recommendation

Only approve purchases deliberately, use a tokenized payment method rather than raw card data, and keep the X-Api-Key private.

What this means

Marketing inputs or product details provided to the skill may be transmitted to the service operator.

Why it was flagged

The skill sends product descriptions, copywriting queries, and optionally MCP requests to an external service endpoint. This is central to the skill's purpose, but it means submitted content leaves the local agent context.

Skill content
Prefer direct REST calls (`/generate`, `/query`) unless your runtime explicitly expects MCP.
Recommendation

Use only non-sensitive marketing material, avoid customer secrets or private business data, and prefer the documented REST endpoints unless MCP is specifically needed.