ClawHub
Back to skill

Security audit

Subscription Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a markdown-only subscription marketing guide with no hidden access or code execution, though users should apply clear consent and easy-cancellation safeguards.

Before installing or using this skill, make sure any subscription UX you create requires clear customer consent, plainly discloses recurring price and billing frequency, keeps one-time purchase easy to choose, and preserves immediate cancellation without coercive save steps.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly recommends pre-selecting a subscription on the product page and visually subordinating the one-time purchase option, which can steer users into recurring billing without sufficiently explicit consent safeguards. In a subscription context, this is dangerous because it increases the risk of dark-pattern enrollment, accidental recurring charges, and consumer-protection noncompliance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The churn-reduction and cancellation-flow guidance emphasizes save tactics and escalating offers, but does not pair them with strong guardrails ensuring cancellation remains easy, unbiased, and legally compliant. In a skill dedicated to maximizing retention and conversion, this omission can normalize manipulative retention patterns that frustrate cancellation, expose users to unwanted charges, and create regulatory and reputational risk.

Content

No source excerpt is available for this finding.