Lead Gen Website Builder (SEO PUR)

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:49 AM UTC
• Version: 1.0.0

Overview

The skill appears aimed at legitimate lead-generation website creation, but its template and guidance create privacy risk by handling lead data and marketing attribution without enough controls.

Review before installing or using this for a real client site. The skill does not look malicious or covert, but generated forms should remove personal-data console logging and add explicit privacy notice, data minimization, retention, recipient, and consent handling for attribution data before production use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to read multiple reference files and write project files, but it does not declare those capabilities explicitly. Undeclared file access reduces transparency and weakens permission review, making it easier for a skill to access or modify workspace content without clear user awareness.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs collection of UTM campaign parameters and says they can be sent to a backend or CRM for attribution, but the top-level description does not clearly disclose this tracking behavior. This creates a privacy and consent risk because marketing attribution data may be processed or combined with contact form submissions without sufficiently explicit notice to the end user.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document recommends UTM tracking on lead forms without mentioning notice, lawful basis, retention, or consent requirements, which can lead implementers to collect marketing attribution data in a non-compliant way. In a lead-generation skill explicitly claiming RGPD compliance, this omission is more dangerous because users may rely on the guidance as privacy-safe by default.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Advising capture of URL UTM parameters without any user warning or privacy controls encourages silent collection of marketing metadata that can be linked to personal contact submissions. Because this skill is for building production lead-gen websites and advertises RGPD compliance, the lack of privacy constraints creates a realistic risk of regulatory non-compliance and unnecessary personal-data enrichment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The form logs submitted personal data, including name, phone, email, message, and marketing attribution fields, directly to the browser console. Console output can be exposed to anyone with local browser access, captured in shared debugging sessions, or persist in logging/monitoring workflows, creating unnecessary privacy and compliance risk for a lead-generation site handling personal data.

VirusTotal

51/51 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.