ClawHub
Back to skill

Security audit

Product Sampling Strategy

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only marketing planning skill is purpose-aligned, with privacy and consent risks to manage before running real campaigns.

Before installing or using this skill for a live campaign, treat it as strategic guidance only and add privacy review steps: use lawfully obtained audience data, disclose pixels and profiling, collect required opt-ins for follow-up messages, honor opt-outs and deletion requests, and validate purchased-list or data-provider terms.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section explicitly instructs users to implement QR surveys, follow-up emails, social listening, pixel tracking, CRM tagging, and audience scoring based on purchase history, demographics, and engagement signals, but it provides no privacy, consent, retention, or lawful-basis guidance. In a marketing skill centered on customer targeting and attribution, that omission can lead users to deploy invasive tracking or profiling practices that violate privacy laws, platform policies, or customer expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The guide explicitly recommends direct mail using purchased or rented mailing lists but provides no caution about consent, lawful basis, suppression lists, or applicable privacy and marketing rules. In a product-sampling skill, this omission can lead users to run campaigns using third-party personal data in ways that create regulatory, reputational, and customer-trust harm.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The template operationalizes collection of targeting, CRM, psychographic, survey, attribution, and conversion data, but provides no prompts to address consent, lawful basis, retention, minimization, or notice to recipients. In a marketing/e-commerce context, this omission can lead users to design campaigns that mishandle personal data or violate privacy requirements, especially when combining multiple data sources and tracking mechanisms.

Content

No source excerpt is available for this finding.