Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed keyword-research helper that installs and pairs a ClawLink plugin for paid public-data lookups, with minor documentation ambiguity around support reporting.
Before installing, understand that this skill depends on the ClawLink plugin, one-time device pairing, and paid third-party public-data calls. It should not be used for private account actions. If troubleshooting asks to report an issue, review or ask what details will be sent to ClawLink first.
The file states that the tools only read public information and that nothing is posted or changed, but later instructs use of an issue-reporting capability that clearly sends data externally. This contradiction can mislead an agent or user into treating all actions as read-only, reducing scrutiny around a tool that performs outbound transmission.
The skill introduces clawlink_report_issue, which sends data to the ClawLink team and is outside the core keyword-research function. Even if intended for support, it creates an outbound communication path that could transmit user prompts, tool arguments, errors, or other context to a third party without being framed as a separate consented action.
The manifest description frames the skill as a keyword research capability, but the file instructs the agent to install a separate plugin, initiate user-device pairing, and rely on an external service account before any research can occur. Those operational behaviors go beyond the plain-language description of a keyword tool, even though they are related to enabling it.
No suspicious patterns detected.
