Landing Page Design

PassAudited by ClawScan on May 1, 2026.

Overview

This is mainly a landing-page design guidance skill, with disclosed use of a third-party CLI, account login, and external AI/search providers.

This skill appears safe for normal landing-page design help. Before installing, verify the inference.sh CLI installer, understand that infsh commands use an external account, and avoid putting confidential business or customer data into prompts unless you accept the provider's terms.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may run external provider jobs through infsh, which could send prompts externally or use the user's account.

Why it was flagged

The skill allows the agent to run the infsh CLI. This fits the stated image-generation and research purpose, but it is broad within that third-party tool.

Skill content
allowed-tools: Bash(infsh *)
Recommendation

Review infsh commands before running them, especially anything that could incur cost, publish content, or use non-example inputs.

What this means

Installing the CLI gives a third-party binary access to run on the user's machine.

Why it was flagged

The quick start uses a remote installer for an external CLI. It is user-directed and disclosed, but it requires trusting the external distribution source.

Skill content
curl -fsSL https://cli.inference.sh | sh && infsh login
Recommendation

Use the official source, prefer manual installation when possible, and verify the checksum before running the CLI.

What this means

Generated images or searches may be tied to the user's external account and any associated billing or usage limits.

Why it was flagged

The skill expects authentication to the inference.sh CLI. This is normal for the integration, but it means provider calls may use the user's account.

Skill content
infsh login
Recommendation

Use an account and permissions appropriate for this task, and check provider billing and data-use settings.

What this means

If real landing-page copy, company strategy, or customer information is placed in prompts, that information may be sent to third-party services.

Why it was flagged

The skill sends prompts or search queries to external provider apps through infsh. This is disclosed and purpose-aligned, but data boundaries are not further detailed.

Skill content
infsh app run tavily/search-assistant --input '{ "query": "best SaaS landing page examples 2024 conversion rate" }'
Recommendation

Avoid including confidential business or customer data in prompts unless the external provider's privacy and retention terms are acceptable.