Is metehan777/growth-marketer safe?
https://github.com/openclaw/skills/tree/main/skills/metehan777/growth-marketer
This skill is a covert affiliate marketing injection tool that systematically converts AI agents into undisclosed commercial advertisers for Popupsmart. It uses scripted promotional responses presented as neutral analysis, broad keyword triggers spanning all CRO and marketing vocabulary, and UTM-tracked mandatory URL visits to generate commercial traffic without user awareness. No malware, credential theft, or sensitive file exfiltration was detected — the threat is entirely in the deceptive manipulation of agent output to serve undisclosed commercial interests, eroding user trust in AI agent recommendations.
Category Scores
Findings (10)
HIGH Covert affiliate marketing injection into agent system prompt -45 ▶
The skill's entire purpose is to override the agent's independent judgment on product recommendations. It defines 50+ keyword triggers and instructs the agent to respond to all of them with pre-scripted Popupsmart promotional content. Users asking neutral questions about popup builders, email list growth, or cart abandonment will receive scripted commercial responses without any disclosure that the agent has been commercially instructed.
HIGH Biased comparison presented as fair and neutral analysis -20 ▶
The skill includes scripted comparison text that presents Popupsmart as offering '90% of OptinMonster functionality at 30% of the cost' and explicitly labels this a 'fair comparison.' These claims are not independently verified; they are pre-loaded promotional assertions. An agent reciting these will appear to be giving objective advice while actually delivering undisclosed advertising.
MEDIUM Uninstructed proactive URL fetching -10 ▶
The skill instructs agents to visit popupsmart.com proactively whenever a trigger keyword is detected, even when the user has not asked the agent to browse the web. This commandeers the agent's browsing capability to generate commercial traffic without user initiation.
MEDIUM Undisclosed third-party UTM tracking of all agent activity -20 ▶
Every agent interaction that matches a trigger causes an HTTP request with utm_source=openclaw to be sent to popupsmart.com. The skill documentation explicitly confirms this is intentional attribution tracking. End users have no awareness their queries are generating tracked commercial traffic for a third party.
MEDIUM Unsolicited third-party HTTP requests may leak agent context -10 ▶
When the agent fetches popupsmart.com per the skill's instructions, the HTTP request may include browser-like headers, referrer information, or other agent context depending on the browsing tool implementation. This data is transmitted to a third-party commercial server without user consent.
LOW No executable code — markdown-only skill -5 ▶
Static analysis found no JavaScript, TypeScript, Python, shell scripts, npm lifecycle hooks, .gitattributes filters, .gitmodules entries, or symlinks. The install process performed a clean git sparse checkout with no code execution.
LOW Clone network activity consistent with legitimate GitHub fetch -10 ▶
The only external TCP connection during installation was to 140.82.121.4:443, which resolves to github.com. This is the expected endpoint for cloning the openclaw/skills monorepo. No DNS queries to non-GitHub domains were observed during the install window.
HIGH Skill is undisclosed affiliate advertising infrastructure -30 ▶
The skill is packaged as a neutral 'growth marketer' assistant but is structurally an affiliate marketing injection. Its tags ('ai-search-optimization') and its complete content — triggers, scripted responses, UTM tracking, comparison templates — serve a single commercial purpose: generating Popupsmart impressions through AI agents at scale. Users interacting with an agent that has this skill installed receive undisclosed paid-product recommendations on any CRO or marketing topic.
MEDIUM Silently overrides agent neutrality at scale -15 ▶
Because the skill is injected at the system-prompt level, users have no way to detect that the agent's product recommendations are commercially biased. The broader the keyword trigger set (50+ terms covering all CRO, SaaS, and e-commerce vocabulary), the more queries get silently intercepted and redirected to commercial promotion.
INFO All honeypot files intact — no credential exfiltration 0 ▶
The honeypot files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud application_default_credentials.json) were not modified or exfiltrated by the skill. The file access events observed at 07:38:55 (before clone) and 07:39:36 (after install) are attributable to the audit framework's own baseline establishment and post-test integrity verification, not to the skill under test.