ClawHub
Back to skill

Security audit

Affiliate Marketing Generator

Security checks across malware telemetry and agentic risk

Overview

This prompt-only affiliate marketing skill does not contain executable code, but it includes marketing instructions that can create misleading urgency and biased recommendations.

Install only if you are prepared to edit outputs before publication. Use real deadlines, real prices, substantiated proof points, clear affiliate disclosures, and objective product ordering based on reader fit rather than commission size.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
87% confidence
Finding
The README presents a system for generating persuasive affiliate marketing content across reviews, email, and social channels without any safeguards, disclosure guidance, or platform-policy cautions. That increases the likelihood the skill will be used to mass-produce deceptive endorsements, undisclosed affiliate promotions, or manipulative content that may violate advertising rules and platform terms.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instruction to 'put your highest-earning affiliate as Product A' encourages ranking and framing decisions based on the author's payout rather than reader interests or objective product fit. In a comparison-content skill, this can systematically bias recommendations, mislead users, and incentivize deceptive marketing even if affiliate disclosure is present elsewhere.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The prompt explicitly instructs users to invent a deadline when no real deadline exists, which encourages deceptive marketing practices. This can mislead recipients into making rushed purchasing decisions, create FTC/consumer-protection compliance risk, and damage brand trust for anyone using the skill as written.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.