ClawHub
Back to skill

Security audit

Testimonial Builder

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a marketing workflow, but it under-specifies consent and privacy controls for reusing customer names, media, testimonials, and support-derived content.

Review this skill before installing if it will touch real customer stories, names, locations, photos, videos, or support conversations. Use it only with documented permission for each marketing use, avoid unnecessary personal details, store media securely, and do not publish or repurpose support-derived content without explicit customer consent and any needed legal review.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly recommends collecting and reusing testimonials, photos, videos, and support-interaction content, but it does not clearly require informed consent, disclosure, or privacy safeguards before repurposing that material. This creates a realistic risk of unauthorized use of personal data, likeness, and support communications, which can lead to privacy violations, regulatory issues, and reputational harm.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The template explicitly structures collection, storage, and reuse of personally identifiable customer data and media assets, but it lacks any privacy notice, data minimization guidance, retention policy, or consent-handling instructions beyond a simple internal 'Usage Rights' field. This creates a real risk of unauthorized processing or reuse of names, locations, images, and testimonial content across marketing channels, especially because the skill is designed to operationalize broad distribution.

Static analysis

No suspicious patterns detected.