Business Tools Pack

7 automation skills for digital product businesses: analytics tracking, autonomous trading signal optimization, customer research, email automation, Gumroad...

Security Scan

The pack's high-level description includes automation that clearly requires sensitive credentials and autonomous activity (trading loop, email deployment, scraping), but the skill bundle declares no required environment variables or install behavior — the pieces don't add up and deserve careful review before installing.

Purpose & Capability

The pack claims features that normally require external credentials and services (ConvertKit/Mailchimp API keys, Gumroad access, broker/API keys for autonomous trading, and access for scraping social platforms). Yet the registry metadata lists no required env vars, no primary credential, and no config paths. That mismatch suggests under-declaration of what this pack actually needs.

Instruction Scope

SKILL.md is an instruction-only pack that tells the agent to install seven sub-skills (including an autonomous trading loop and social scraping). The instructions do not describe the credentials or configuration those sub-skills will need, nor any data handling, consent, or rate-limiting for scraping. Autonomous trading and automated scraping are high-impact actions; omission of run-time details is a scope/clarity problem.

Install Mechanism

There is no install spec in the bundle itself (instruction-only), which reduces immediate disk-write risk. However, the Quick Start instructs use of 'clawhub install' to fetch seven other skills from unknown sources; those sub-skill installs could pull arbitrary code. The pack provides no homepage or source link to verify the provenance of the sub-skills.

Credentials

README explicitly notes that some skills require API keys and Python, but the registry metadata declares no required environment variables or primary credential. Features like email deployment, Gumroad page creation, testimonial collection, and an autonomous trading loop ordinarily require multiple sensitive secrets (email service API keys, payment platform tokens, broker API keys). The absence of declared env requirements is disproportionate and opaque.

Persistence & Privilege

always:false and default autonomous invocation are set (normal). The real risk is functional: one included skill is an 'autonomous trading signal optimization loop' which, if installed and allowed to run autonomously, could execute sustained external actions with sensitive credentials. The pack does not document safeguards, sandboxing, or required permissions for autonomous runs.

What to consider before installing

Do not install this pack blindly. Before proceeding: 1) Inspect each included sub-skill (analytics-tracking-dv, autosignals-davinci, customer-research-dv, etc.) — open their SKILL.md and any code to see what env vars, API endpoints, and files they access. 2) Verify provenance: ask for source/homepage or repository links so you can review code and release history. 3) Do not supply production API keys (email services, Gumroad, payment/broker APIs) until you’ve reviewed the sub-skill code; use sandbox/test accounts first. 4) Be cautious about the AutoSignals component — autonomous trading can cause financial loss; require manual approval or run in read-only/simulated mode initially. 5) Confirm scraping behavior complies with target sites’ ToS and privacy rules and that any collected user/customer data is handled securely. If the author cannot provide clear, auditable sources and a list of required credentials with justification, treat the pack as risky.

7 automation skills for solo founders and digital product businesses.

Included Skills

1. Analytics & Tracking — UTM links, pixels, attribution setup
2. AutoSignals — Autonomous trading signal optimization loop
3. Customer Research — Social listening and pre-launch validation
4. Email Automation — ConvertKit/Mailchimp sequence deployment
5. Gumroad Page Generator — High-converting sales page copy from specs
6. Testimonial Collector — Automated day-3/7/14 review collection
7. First Principles Analyzer — Deep assumption-stripping analysis

Quick Start

clawhub install analytics-tracking-dv
clawhub install autosignals-davinci
clawhub install customer-research-dv
clawhub install email-automation-dv
clawhub install gumroad-page-gen-dv
clawhub install testimonial-collector-dv
clawhub install first-principles-dv

License

MIT