Security audit
Security checks for vulnerabilities and agentic risk
The skill is a marketing analytics helper, but it asks users to process customer communications and connect CRM/LLM integrations without enough privacy and scoping guidance.
Review this skill before installing in a production workspace. Use it only with data you are authorized to process, redact personal identifiers where possible, confirm your OpenAI/Anthropic and integration data-processing terms, and use least-privilege tokens for Slack, HubSpot, Google Sheets, WordPress, and Intercom. Treat its compliance claim as unsupported unless your own privacy review confirms lawful basis, consent, retention, and vendor obligations.
Referenced artifact was not completely inspected
{"openclaw":{"requires":{"env":["OPENAI_API_KEY","ANTHROPIC_API_KEY"],"bins":["python3","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"🎯"}}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
export WORDPRESS_API_TOKEN="..."
# For Google Sheets export (audience maps)
export GOOGLE_SHEETS_CREDENTIALS="path/to/credentials.json"
export TARGET_SPREADSHEET_ID="..."
# For Intercom support ticket mining
The skill explicitly instructs users to process support tickets, email threads, comments, CRM identifiers, and multiple API credentials, but it does not provide a meaningful warning that this data may be sent to external LLM providers or third-party integrations. Because the workflow includes customer emails, behavioral profiling, and credential-backed exports, users could unknowingly expose regulated personal data or business-sensitive information to systems outside their expected trust boundary.
The statement that the skill is 'GDPR, CCPA, and privacy-law compliant' is an unqualified legal and security assurance that the skill itself cannot guarantee. Such blanket claims can mislead operators into processing personal data without performing required vendor, consent, transfer, retention, and lawful-basis reviews, increasing the chance of noncompliant deployment.
No suspicious patterns detected.