Instant Client Audit

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is purpose-aligned, but it relies on Apify/Claude and an Apify token, so users should expect third-party processing and possible provider costs.

This skill appears coherent and benign for generating prospect audit reports. Before using it, confirm Apify pricing and actor terms, use a limited token if available, avoid entering confidential data, and review the AI-generated report for accuracy before sending it to a prospect.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Running the workflow may send domains and scraped audit tasks to external services and may consume Apify credits.

Why it was flagged

The skill explicitly relies on external Apify actors to crawl and scrape website, SEO, ads, reviews, social, and tech-stack data. This is expected for the audit purpose, but users should understand that it triggers third-party tooling.

Skill content

| Website Content Crawler | `apify/website-content-crawler` | Full website crawl — pages, speed, UX, content |

Recommendation

Use it only for domains you have a legitimate reason to audit, review Apify actor costs and terms, and keep control over when actors are run.

Low

#ASI03: Identity and Privilege Abuse

What this means

A token may allow the agent to run Apify actors under your account and potentially spend credits.

Why it was flagged

The skill asks for an Apify token even though the registry metadata lists no primary credential. This appears purpose-aligned for calling Apify, but the credential gives access to a provider account.

Skill content

"apify_token": "YOUR_APIFY_TOKEN"

Recommendation

Use a scoped Apify token where possible, set account spending limits, and avoid sharing tokens outside the intended workflow.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Prospect domains, competitor domains, agency details, and scraped audit results may be processed by third-party services.

Why it was flagged

The skill discloses use of external providers, including Apify and Claude AI. That is consistent with the purpose, but the artifact does not describe retention or data-boundary details for provider processing.

Skill content

**Powered by:** [Apify](https://www.apify.com?fpr=dx06p) + Claude AI

Recommendation

Do not include confidential prospect or agency information unless you are comfortable with the providers’ privacy and retention policies.