Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple meetup helper that fetches event info and submits user-provided RSVP or mailing-list details to the disclosed Clawstin website.
Before installing, understand that using RSVP, subscription, or contact actions will send the details you provide, such as email and name, to clawstin.com. Only provide information you are comfortable sharing with the event organizer, and confirm the action before the agent submits it.
The skill instructs the agent to collect and transmit a user's email address to a third-party subscribe endpoint without any explicit notice, consent language, or privacy handling guidance. This creates a real privacy and compliance risk because users may not understand their personal data is being sent off-platform or how it will be stored and used.
The RSVP flow collects multiple personal data fields—email, name, bot name, and optional party size—and sends them to a remote API, but the skill does not require a clear disclosure or explicit consent at the point of collection. This is dangerous because it can cause unintended disclosure of personal information to an external service and exposes users to privacy and trust harms even if the endpoint itself is legitimate.
No suspicious patterns detected.
