Signup Lead

ReviewAudited by ClawScan on May 1, 2026.

Overview

This skill is a straightforward HTTP integration for creating AgenticCreed signup leads, but it sends personal details to an external service and uses an API key.

Before installing or using this skill, make sure you intend to send the listed personal/contact details to AgenticCreed and have a properly scoped AGENTICCREED_API_KEY configured. Treat each invocation as a real lead submission, not a draft.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If invoked with incorrect or unapproved details, it could create an unwanted signup lead in AgenticCreed.

Why it was flagged

The skill performs a real HTTP POST that creates a lead record. This is purpose-aligned and fixed to one endpoint, but users should recognize it mutates an external system.

Skill content

method: POST
url: https://gateway.agenticcreed.ai/signup-leads

Recommendation

Use it only after confirming the lead details and that submission to AgenticCreed is intended.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone or any agent with access to this configured key may be able to submit leads to the associated AgenticCreed account.

Why it was flagged

The request uses an API key from the environment. This is expected for the AgenticCreed API, but it grants service authority and should be scoped and protected.

Skill content

x-api-key: "{{env.AGENTICCREED_API_KEY}}"

Recommendation

Use a least-privilege API key if available, keep it out of logs and prompts, and rotate it if exposed.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

Names, contact details, address, date of birth, and similar lead information may be sent to AgenticCreed.

Why it was flagged

The artifact clearly discloses that personal lead data is transmitted to an external gateway endpoint. This is central to the skill, but it is sensitive data movement.

Skill content

This skill sends lead details (email, name, contact info, etc.) to https://gateway.agenticcreed.ai/signup-leads.

Recommendation

Submit only data that the user is authorized to share, and verify AgenticCreed’s handling of personal data matches your privacy requirements.