ClawHub
Back to skill

Security audit

influencer-marketing-manager

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent influencer-marketing workflow guide with disclosed outreach authority and clear confirmation gates for external messages and commitments.

Install this only if you want an agent to help manage influencer-marketing workflows, including drafting and potentially sending creator outreach under approved rules. Review any project rules carefully, especially who may be contacted, what data may be shared, approved sender identities, suppression or opt-out handling, budgets, rights, and commercial terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The 'When to use' guidance covers nearly any marketing decision or evolving creator relationship across strategy, outreach, negotiation, fulfillment, and measurement. While some scoping language is present, it does not provide explicit trigger phrases, exclusion examples, or concrete negative cases, which can lead to unintended invocation for general marketing tasks.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The playbook gives operational instructions for preparing and sending outreach to creators, including verifying recipients and sending external messages, but it does not explicitly require user awareness/approval for third-party contact or clearly warn that creator/user data will be transmitted outside the system. In an autonomous agent context, this can lead to unintended external communications, privacy issues, or reputational harm if the agent proceeds based only on internal workflow logic.

Static analysis

No suspicious patterns detected.