other
Warning
- Location
SKILL.md:221- Finding
Uncontrolled Collection and Marketing Reuse of Buyer Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Fiverr Gig Optimizer
Security checks for vulnerabilities and agentic risk
Overview
This skill is a non-executable Fiverr coaching guide, but it gives under-scoped advice to collect buyer data and move repeat clients off-platform in ways that could violate marketplace or privacy rules.
Review this skill carefully before installing. It may be useful for gig copy, pricing, and funnel diagnosis, but avoid following its off-platform migration, direct-billing, CRM, or email-list advice unless you have verified the current marketplace terms and obtained proper consent for any buyer data use.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The off-platform path section encourages moving repeat buyers to direct billing after a set period and suggests techniques for external re-introduction, which can pressure users toward violating marketplace anti-circumvention rules. In this skill's context, that is especially dangerous because the advice is operational and actionable, making account suspension, disputes, loss of buyer protections, and policy abuse more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description says to use the skill when asked to write or improve a Fiverr gig, raise impressions, structure pricing tiers, design gig images, or migrate clients off-platform, which spans many common coaching requests without clear boundaries for when this skill should or should not activate. Although some explicit trigger phrases are listed, the broader 'Use when asked...' wording lacks constraints or negative examples and could cause unintended invocation for generic marketing or freelance-advice prompts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill metadata and description explicitly include helping users 'migrate clients off-platform' without a strong up-front warning about marketplace terms, account sanctions, privacy obligations, or contractual restrictions. Embedding this as a normal use case makes policy-sensitive behavior seem endorsed and increases the chance of unsafe guidance being delivered in routine interactions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly advises maintaining private buyer lists/CRMs and moving repeat buyers off-platform, which goes beyond neutral gig optimization and enters guidance for bypassing marketplace controls and retention mechanisms. In this context, the advice can facilitate policy evasion, improper handling of buyer data, and reduced platform oversight of transactions and disputes.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Advising users to add buyers to a private list/CRM after every delivery encourages collection and secondary use of client information without any warning about consent, data minimization, confidentiality, or applicable privacy rules. In a marketplace context, this can create legal/privacy exposure and may conflict with platform expectations around customer data use.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill recommends adding very low-priced offerings or aggressively pricing for 90 days primarily to increase order count and clear seller-level thresholds. While framed as growth advice, this is effectively manipulation of platform progression metrics rather than service-quality improvement, and it may push users toward spammy, low-value, or policy-sensitive marketplace behavior.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The trigger list includes 'top rated,' which is a common phrase that can refer to products, services, media, or reviews in many unrelated contexts. Without requiring nearby Fiverr-specific context, this phrase risks activating the skill on ordinary conversation that is not about Fiverr seller optimization.
- Content
Static analysis
No suspicious patterns detected.