AgenticCreed SignUP Lead

• Verdict: Pass
• Confidence: High
• Analyzed: May 1, 2026, 5:34 AM
• Findings: 3
• Version: 1.0.1

Overview

This skill is a simple, disclosed HTTP signup-lead submission tool, but it sends personal details to an external service and uses an API key that is not declared in the registry metadata.

This appears coherent and purpose-aligned. Before installing, confirm you trust the AgenticCreed endpoint, set only an appropriate API key, and use the skill only when you intend to submit the provided personal lead details.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

NoteHigh Confidence

What this means

If invoked with real details, the skill may create a new lead record in AgenticCreed.

Why it was flagged

The skill performs a state-changing HTTP POST to create a lead record. This is the stated purpose and is limited to one endpoint, but users should understand it creates data in an external system.

Skill content

method: POST
  url: https://gateway.agenticcreed.ai/signup-leads

Recommendation

Use it only when the user intends to submit those lead details, and verify the information before invoking it.

ASI03: Identity and Privilege Abuse

NoteHigh Confidence

What this means

The skill will act with whatever permissions the configured AgenticCreed API key has.

Why it was flagged

The skill uses an API key from the environment to authenticate to AgenticCreed. This is purpose-aligned, but the registry metadata says there are no required environment variables or primary credentials.

Skill content

x-api-key: "{{env.AGENTICCREED_API_KEY}}"

Recommendation

Use a least-privilege API key if available and confirm the API key requirement before installation.

ASI07: Insecure Inter-Agent Communication

NoteHigh Confidence

What this means

Personal information such as email, address, date of birth, and phone number may be sent to AgenticCreed.

Why it was flagged

The skill explicitly sends personal lead data to an external AgenticCreed gateway endpoint. This is disclosed and matches the purpose, but it is sensitive data transfer.

Skill content

This skill sends lead details (email, name, contact info, etc.) to https://gateway.agenticcreed.ai/signup-leads.

Recommendation

Submit only information the user is authorized to share with AgenticCreed and avoid unnecessary personal fields.