Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Customer Churn Prediction Analyst

v1.0.0

Analyze customer behavior patterns and predict churn risk across Stripe, Shopify, and SaaS platforms. Identify at-risk accounts, generate personalized interv...

0· 95·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name and description (Stripe, Shopify, SaaS, Slack integrations) align with requiring STRIPE_API_KEY and SHOPIFY_API_TOKEN. Requiring OPENAI_API_KEY is plausible for generating text outputs. However, the skill repeatedly references Slack and generic 'SaaS platforms' without declaring Slack or other platform tokens/credentials — this is an unexplained gap (either the skill expects user-provided data exports for those systems, or it will ask for additional credentials at runtime).
!
Instruction Scope
This is an instruction-only skill that will orchestrate API calls and analysis using python3/curl and the provided keys. Because OPENAI_API_KEY is required, the skill will (or can) send customer and billing data to an external LLM service for analysis/templating; the SKILL.md does not appear to mandate redaction or consent handling. The instructions also describe ingesting email/CRM/support ticket data but do not request CRM credentials — which suggests either the skill will ask the user to upload raw exports or prompt for additional tokens, both of which increase risk of sensitive data being transmitted externally.
Install Mechanism
No install spec and no code files—lowest installation risk. The skill is instruction-only and relies on existing python3 and curl binaries; nothing is being downloaded or written by an installer step.
Credentials
Requested environment variables (STRIPE_API_KEY, SHOPIFY_API_TOKEN, OPENAI_API_KEY) are relevant to the core features. However: (1) OPENAI_API_KEY gives the skill the ability to send potentially sensitive customer data to an external service — this is a significant privacy/data-governance consideration; (2) other platforms mentioned (Slack, CRMs, support systems) have no declared env vars, creating ambiguity about how their data will be accessed.
Persistence & Privilege
always is false and there is no install script or code that writes to disk. The skill does not request elevated or persistent platform privileges. Autonomous invocation is allowed by default but not combined here with 'always: true' or other high privileges.
What to consider before installing
Key points to consider before installing or running this skill: - Data exfiltration risk: The skill requires OPENAI_API_KEY, which means customer data could be sent to OpenAI for analysis or text generation. Do not provide full PII/payment data unless you are comfortable with that external processing and have legal/contractual approval. - Least privilege: If you proceed, create and use restricted API keys where possible (Stripe restricted key with read-only scopes, Shopify token limited to necessary endpoints) and rotate keys after use. - Test with anonymized samples: Run the skill on scrubbed or synthetic customer data first to observe what is sent to external endpoints and what outputs are produced. - Confirm missing credentials flow: The SKILL.md mentions Slack and other SaaS integrations but does not request Slack/CRM credentials. Ask the publisher how those integrations are implemented and whether the skill will prompt you for additional tokens or expects file uploads. - Audit and logging: Ensure you can audit API calls (Stripe/Shopify logs) to detect unexpected access. Avoid putting long-lived high-privilege keys into the environment. - Source verification: The skill lists a GitHub homepage but 'Source: unknown' in the registry. Review the linked repo and author, and prefer skills with transparent maintainers and code available. If you cannot confirm how data is handled (redaction, retention, third-party transmission) or cannot limit credentials, treat this skill as high-risk and do not provide production customer data.

Like a lobster shell, security has layers — review code before you run it.

latestvk979qfvkav8jzgyc1j12dsv8c1832zgc

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

📊 Clawdis
OSmacOS · Linux · Windows
Binspython3, curl
EnvSTRIPE_API_KEY, SHOPIFY_API_TOKEN, OPENAI_API_KEY

Comments