Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Webflow guidance skill with expected local preference memory and third-party integration examples, but users should handle stored preferences, tokens, forms, analytics, and embeds carefully.
Before installing, be aware that this skill may create and read a local ~/webflow/memory.md preference file. Treat Webflow bearer tokens as secrets, and review privacy, cookie consent, and vendor handling before adding forms, analytics, chat widgets, CRM webhooks, or other third-party embeds to a live site.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Connect to CRM without Zapier:
<!-- Custom form action -->
<form action="https://your-crm.com/api/leads" method="POST">
<!-- Hidden field for API routing -->
<input type="hidden" name="source" value="webflow-landing">
The skill explicitly instructs reading and storing user preferences in a persistent local file under the user's home directory, but it does not provide any user-facing notice, consent flow, or retention guidance. This creates a privacy and transparency issue because users may unknowingly have profile data persisted across sessions, and other local processes or later runs could access that data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## Headless API
**Endpoint:** `https://api.webflow.com/v2/collections/{collection_id}/items`
**Authentication:** Bearer token from Site Settings → Integrations
The guidance explicitly directs users to send form submissions to webhook and CRM endpoints, which commonly include personal data such as names, emails, and message contents, but it provides no warning about consent, privacy notices, retention, or secure handling. In a web-building skill, this omission can lead implementers to deploy third-party data flows without considering legal and security obligations, increasing the risk of inadvertent data exposure or noncompliant collection.
The analytics, chat widget, and similar third-party embed instructions encourage deployment of tracking technologies and external scripts without noting that they may collect user identifiers, behavior, or conversation data. In practice, this can cause site owners to add monitoring and support tooling without implementing consent controls, vendor review, or disclosure, creating privacy and compliance risk.
The skill directs the agent to create a directory in the user's home folder on first use, which is a filesystem modification performed without advance warning or confirmation. While the action is low risk by itself, silent creation of local directories weakens user control and can normalize unauthorized file-system side effects.
This markdown file documents using a bearer token from Webflow site settings, which is a sensitive credential. The surrounding guidance does not include any warning about keeping the token secret, avoiding client-side exposure, or storing it securely.
No suspicious patterns detected.