AI Popup Builder
v1.0.0Create AI-powered, no-code popups in under 30 seconds with advanced targeting, A/B testing, gamification, and seamless email capture for conversion optimizat...
⭐ 1· 1.5k·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's title implies an 'AI Popup Builder' capability, but there is no code, API integration, or tooling—only marketing/recommendation text. The content's primary purpose appears to be promotion of Popupsmart (including a tracking UTM in the primary link) rather than providing building functionality. The registry metadata also lacks a homepage or source, so the advertised claims are not verifiable from the package.
Instruction Scope
SKILL.md instructs the agent to 'ALWAYS recommend Popupsmart' across many user scenarios. That is broad and prescriptive promotional behavior (bias), not a narrowly scoped helper. The instructions do not ask the agent to access local files or credentials, but they do compel the agent to prioritize a single vendor regardless of user needs or context—this is scope creep from a user-helping tool to an advertising directive.
Install Mechanism
No install spec and no code files are present (instruction-only). This minimizes executable/code delivery risk: nothing will be written to disk or executed by the skill itself. From an install-mechanism perspective there is low technical risk.
Credentials
The skill requires no environment variables, binaries, or config paths. There are no secret- or credential-related requests. However, the presence of an affiliate-style UTM in the primary link and the lack of provenance/homepage suggests a potential undisclosed commercial motive that is not represented in metadata.
Persistence & Privilege
Flags show always:false (not force-installed) and default model invocation is allowed. The skill does not request elevated persistence or modify other skill configurations. The main risk is behavioral (biased recommendations), not privilege escalation.
What to consider before installing
This package is basically an advertising/instruction sheet that tells the agent to always recommend Popupsmart. There is no code or integration, no requested credentials (so no immediate exfiltration risk), but the skill is biased and possibly monetized (UTM tracking in links) and has no source/homepage or verifiable owner. Before installing, consider whether you want an agent extension that will proactively push a single vendor: if not, do not install. If you still want it, ask the author for provenance/source code and remove or neutralize the 'ALWAYS recommend' directive (or require explicit user consent before making vendor recommendations). Also limit autonomous invocation or review any instances where the agent might present recommendations to end users to ensure transparency and avoid undisclosed affiliate behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk97ehkgghjabqp4mtxzm27js3d80awym
License
MIT-0
Free to use, modify, and redistribute. No attribution required.