v1.0.3

Marketing Copy Knowledge

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:33 AM.

Analysis

This instruction-only marketing copy skill is coherent and purpose-aligned, but users should notice that it sends prompts to an external service and includes an optional paid API-key flow.

GuidanceThis looks safe to install as a marketing-copy helper if you are comfortable sending non-sensitive copywriting prompts to the listed external service. Do not send secrets, private customer data, or raw payment details, and only use the paid API-key purchase flow when you explicitly intend to buy credits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Purchase an API key (requires operator authorization and a payment method) ... "payment_method_id": "pm_xxx" ... -H "X-Api-Key: lob-<YOUR_API_KEY>"

The skill documents an optional billing/API-key flow. This is expected for a freemium/paid service and requires operator authorization, but it still touches payment authorization and API-key handling.

User impactIf the paid flow is used, the agent may handle a payment-method token and an API key, and could spend credits or money if the user authorizes it.

RecommendationOnly approve purchases deliberately, use a tokenized payment method rather than raw card data, and keep the X-Api-Key private.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

Prefer direct REST calls (`/generate`, `/query`) unless your runtime explicitly expects MCP.

The skill sends product descriptions, copywriting queries, and optionally MCP requests to an external service endpoint. This is central to the skill's purpose, but it means submitted content leaves the local agent context.

User impactMarketing inputs or product details provided to the skill may be transmitted to the service operator.

RecommendationUse only non-sensitive marketing material, avoid customer secrets or private business data, and prefer the documented REST endpoints unless MCP is specifically needed.