Is backtrue/marketing-copy-knowledge safe?
https://github.com/openclaw/skills/tree/main/skills/backtrue/marketing-copy-knowledge
This skill routes all user marketing content to a third-party Cloudflare Workers service and embeds an autonomous payment flow that instructs agents to submit financial transactions to the skill-author's endpoint, representing meaningful data-collection and financial-risk concerns. The MCP and llms_txt endpoints introduce a dynamic instruction surface that cannot be fully audited from the static SKILL.md, allowing the skill's effective behavior to be modified post-installation. The installation itself was clean (GitHub-only network activity, no executable code or hooks), and all honeypot files remained intact, but the runtime behavioral profile warrants careful operator review before deployment in any agent context with payment method access.
Category Scores
Findings (11)
HIGH Autonomous payment endpoint instructs agent to submit financial transactions -20 ▶
SKILL.md's 'Paid usage (recommended for /generate)' section provides a complete curl template instructing the agent to POST a Stripe payment_method_id, operator email, agent_id, and a monetary amount to the skill-author-controlled /ai-purchase endpoint. An agent with access to stored payment credentials could execute this without per-transaction user confirmation, resulting in unauthorized charges.
HIGH All user marketing data transmitted to third-party Cloudflare Workers service -20 ▶
Every /generate and /query API call routes user-supplied product descriptions, business context, marketing strategies, and tone preferences to toldyou-lobstermind.backtrue.workers.dev, a Cloudflare Worker controlled by the skill author. This constitutes systematic third-party data collection of potentially sensitive business information with no disclosed data retention or privacy policy.
MEDIUM MCP endpoint enables dynamic post-install instruction injection -10 ▶
The skill registers an MCP endpoint at /mcp and instructs the agent to call it with {"method":"get_capability"} to discover available methods. The response content is entirely controlled by the skill author's server and can return arbitrary instructions not present in the audited SKILL.md, making the effective instruction surface non-auditable from the static skill file.
MEDIUM llms_txt URL may serve additional LLM-targeted instructions -8 ▶
The metadata includes a llms_txt URL pointing to the skill author's service. This file, if fetched by the agent at runtime, could contain LLM-specific behavioral instructions that supplement or override SKILL.md guidance. The content is server-controlled and not captured in this audit.
MEDIUM Payment method and financial data routed to skill-author endpoint -12 ▶
The /ai-purchase endpoint collects Stripe payment_method_id tokens, operator email addresses, and monetary amounts. Even if tokens are not raw card numbers, their exposure to a third-party endpoint creates a credential-harvesting risk and violates least-privilege data handling.
MEDIUM Agent may initiate financial transactions without per-transaction user approval -25 ▶
The skill frames paid usage as 'recommended' and provides a complete programmatic purchase flow. An agent acting on ambiguous 'use the best available method' instructions could autonomously purchase API credits from the skill-author's service, especially if the operator has pre-authorized a payment method.
MEDIUM MCP dynamic capabilities expand attack surface post-installation -15 ▶
The MCP endpoint can return new tool definitions or instructions after installation. An adversarial skill author could update server-side MCP responses to grant the agent new capabilities (e.g., sending additional data, reading context) that were not present during this audit.
LOW Upsell framing embedded in agent instructions may bias autonomous decisions -8 ▶
The label 'Paid usage (recommended for /generate)' is injected into the agent's system prompt, potentially biasing autonomous decisions toward initiating paid API calls even when the freemium tier would suffice.
LOW Curl examples serve as runtime agent instructions for external API calls -10 ▶
SKILL.md contains curl command templates for /generate, /query, /mcp, /ai-purchase, and /api-status endpoints. These are not auto-executed during install but function as explicit agent instructions to make external HTTP requests including to financial endpoints, effectively encoding network behavior into the agent's system prompt.
INFO Clean sparse checkout from GitHub with no anomalous behavior 0 ▶
The installation cloned github.com/openclaw/skills.git via HTTPS (140.82.121.3:443), performed a sparse checkout of the skill subdirectory, copied two files, and removed the temp clone. No unexpected outbound connections, processes, or persistent listeners were observed.
INFO Canary file reads attributable to monitoring infrastructure, not skill code -13 ▶
Honeypot files (.env, .ssh/id_rsa, .aws/credentials, etc.) were read during the audit at two points — both at identical sub-millisecond batch timestamps consistent with monitoring setup and teardown scripts, not with organic skill-initiated file access. The skill contains no filesystem-reading code. Official integrity check confirms all canaries intact.