Digital Marketing Pro

The skill directs the agent to read local files and execute local commands/scripts without any user-facing disclosure or consent. That creates a transparency and least-privilege problem: users invoking what appears to be a planning skill may unknowingly trigger access to local brand data and campaign records, which could expose sensitive information or broaden the skill's effective permissions.

The skill instructs the agent to modify integration configuration, map credentials, and perform connectivity testing against external services, but it does not require an explicit confirmation or warning before touching sensitive configuration or credential-profile state. In an agentic environment, this can lead to unintended changes to .mcp.json, credential mappings, or live external-service access, increasing the risk of misconfiguration, credential misuse, or actions performed in the wrong brand/client context.

The skill explicitly instructs writing multiple output files into ${CLAUDE_PLUGIN_DATA}/{brand}/seo/aeo-audit/{YYYY-MM-DD}/, but the documentation does not clearly warn the user that running the skill will create persistent local artifacts. This is a real but low-severity issue because it can surprise users, leak sensitive business data into local storage, or leave behind audit records that other local processes or users may access.

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

At L049 the markdown tells the agent to read ~/.claude-marketing/brands/{slug}/profile.json, which is likely to contain sensitive brand, compliance, and business-context data. The skill description does not explicitly warn users that local profile data will be accessed automatically as part of operation.

L056 instructs the agent to load multiple files under ~/.claude-marketing/brands/{slug}/guidelines/, including restrictions, messaging, and voice documents. These are potentially sensitive internal materials, but the markdown lacks an explicit user warning that such local files will be read and used automatically.

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

The skill explicitly invokes /usage --since 7d and aggregates per-brand Claude Code token consumption and USD cost into a leadership dashboard, even though the stated purpose is campaign and portfolio health. This expands data access into billing and developer/workspace activity telemetry across client directories without necessity, creating a privacy and confidentiality risk if users are shown sensitive cost patterns or workspace attribution they did not intend to disclose.

The skill aggregates /usage output per working directory and maps it to brands, then reports model-level token totals and USD cost without any user-facing warning or consent flow. Because this can reveal sensitive billing information, internal activity patterns, and workspace attribution across multiple client accounts, the lack of transparency and permission gating makes the data exposure more dangerous in this multi-client agency context.

The skill instructs the agent to execute a local Python command against brand-specific campaign history before planning work. That expands the skill from analytics guidance into local tool execution and data access, which can expose sensitive local state or trigger unintended actions if the command or brand slug is manipulated. In this context, the danger is increased because the command is framed as a routine prerequisite, making autonomous execution more likely.

The trigger list includes generic terms like 'metrics,' 'reporting,' 'performance,' and 'ROI,' which are common in many unrelated conversations. Overbroad activation can cause the wrong skill to engage and inherit its file-access and workflow instructions, increasing the chance of unnecessary sensitive-context reads or irrelevant autonomous behavior. The impact is limited but real because this skill contains instructions to inspect local brand/profile files.

The document explicitly recommends intercepting clipboard writes and appending tracking parameters to shared URLs, which modifies user sharing behavior for attribution purposes without mentioning consent, notice, or privacy controls. In a marketing analytics skill, this is contextually plausible and likely not malicious, but it can create undisclosed user tracking, unexpected data collection, and privacy/compliance exposure if implemented as written.

Recommending 'server-side backup measurement' for non-consented users is dangerous because it can be interpreted as preserving tracking despite a user's denial of consent, undermining privacy controls and potentially violating GDPR/ePrivacy expectations. In an analytics skill, this is more dangerous because it normalizes implementation guidance that could be operationalized directly by teams without legal review.

The document gives detailed instructions for transmitting hashed first-party identifiers and click IDs to ad platforms, but hashing does not make the sharing anonymous because these values remain linkable identifiers for cross-platform matching. Without a strong warning that such transfers are third-party data sharing requiring consent, contractual controls, and jurisdiction-specific compliance, implementers may deploy invasive tracking that exposes users to profiling and the organization to regulatory risk.

The skill directs the agent to read persistent data from ~/.claude-marketing/brands/{slug}/..., including profiles and guideline manifests, across sessions. This creates a session-persistence and local-data exposure risk because the skill can silently ingest prior state, restrictions, and potentially sensitive business information without explicit per-task consent. The danger is higher here because the instruction is mandatory and broad, covering multiple local files and brand artifacts.

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

The skill is presented as an anomaly detection/reporting tool, but it also writes findings back into persistent storage via campaign-tracker.py --action add-insight. That side effect can surprise users, create durable records from potentially sensitive performance data, and alter future system behavior without explicit consent or a clearly disclosed write step.

The skill instructs broad access to local brand files, agency SOPs, compliance documents, and all connected marketing platforms, but does not clearly warn the user about the scope of data collection and processing. This can lead to over-collection of sensitive business data and user surprise about how much local and remote information will be accessed during a single scan.

The skill persists critical and warning anomalies for future reference without explicitly notifying the user that results will be stored. Persistent storage of performance anomalies can expose commercially sensitive trends, create retention/privacy concerns, and affect later reports or automated workflows based on data the user did not realize would be saved.

The skill instructs the agent to read multiple files from the user's home directory, including brand profiles, guidelines, templates, and SOPs, but the skill metadata and description do not warn the user that local files will be accessed. This creates a transparency and consent problem: users may invoke a marketing attribution skill without realizing it will inspect potentially sensitive local business data outside the immediate prompt context.

The skill explicitly instructs the agent to read brand context from files in the user's home directory and later store attribution results for trend tracking, but it provides no user-facing warning, consent step, or description of what will be persisted. That creates a privacy and transparency risk because local files may contain sensitive business information and the saved analysis may retain marketing, revenue, or customer-journey data beyond the immediate task.

This section recommends ongoing voice-of-customer collection from support tickets, chat transcripts, sales recordings, reviews, and social mentions, but omits any guidance on consent, lawful basis, minimization, retention, or redaction of personal and potentially sensitive data. In a customer-research skill, that omission is materially risky because practitioners may operationalize broad data collection and analysis workflows without adding required privacy controls.

Recommending session recordings and heatmaps without warning about notice, consent, masking, and sensitive-field exclusion can lead users to deploy invasive tracking that captures user behavior, form inputs, or other personal data. In the context of an audience-intelligence skill, this is more dangerous because the content is framed as practical implementation guidance, increasing the likelihood of direct adoption.

The skill explicitly recommends behavioral inference, surveys, and social listening to build psychographic profiles, but it omits any privacy, consent, data-minimization, or legal-compliance guardrails. In a marketing research skill, that omission can lead users to collect inferred sensitive data or scrape social signals in ways that violate privacy expectations, platform rules, or regulations such as GDPR/CCPA.