Security audit

Digital Marketing Pro

Security checks across malware telemetry and agentic risk

Overview

This is a broad marketing operations plugin that reads and writes local brand data and can use optional connectors, but those behaviors are disclosed and aligned with its stated purpose.

Install only if you are comfortable with this plugin maintaining local and optional Drive-based client marketing records. Enable only the connectors you need, keep API keys in environment variables or platform OAuth flows, protect ~/.claude-marketing and shared Drive folders, and have legal/privacy review before applying tracking guidance such as hashed identifier sharing, server-side measurement, session recordings, or clipboard/UTM share tracking.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (318)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to read local files and execute local commands/scripts without any user-facing disclosure or consent. That creates a transparency and least-privilege problem: users invoking what appears to be a planning skill may unknowingly trigger access to local brand data and campaign records, which could expose sensitive information or broaden the skill's effective permissions.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill instructs the agent to modify integration configuration, map credentials, and perform connectivity testing against external services, but it does not require an explicit confirmation or warning before touching sensitive configuration or credential-profile state. In an agentic environment, this can lead to unintended changes to `.mcp.json`, credential mappings, or live external-service access, increasing the risk of misconfiguration, credential misuse, or actions performed in the wrong brand/client context.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill explicitly instructs writing multiple output files into `${CLAUDE_PLUGIN_DATA}/{brand}/seo/aeo-audit/{YYYY-MM-DD}/`, but the documentation does not clearly warn the user that running the skill will create persistent local artifacts. This is a real but low-severity issue because it can surprise users, leak sensitive business data into local storage, or leave behind audit records that other local processes or users may access.

Context Leakage

High

Category: Data Exfiltration
Content: - **ChatGPT**: Test with latest model. Note that responses vary by session — test 2-3 times. Web-search mode on. - **Perplexity**: Check both the answer AND the cited sources list. - **Google AI Mode (May 2026, default)**: Test from the AI Mode tab (or directly via the conversational entry point that appears for opted-in users). Gemini 3.5 Flash backbone. Capture the full conversational thread including any follow-up clarifiers — citations evolve across turns. AI Mode often selects different sources than AI Overviews for the same query. - **Google AI Overviews**: Not all queries trigger AI Overviews — document which do. This is the SERP summary block, separate from AI Mode. - **Gemini**: Test via gemini.google.com, note any "I don't have enough info" responses. - **Copilot**: Test in Bing chat mode for web-grounded responses.
Confidence: 75% confidence
Finding: Capture the full conversation

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: At L049 the markdown tells the agent to read `~/.claude-marketing/brands/{slug}/profile.json`, which is likely to contain sensitive brand, compliance, and business-context data. The skill description does not explicitly warn users that local profile data will be accessed automatically as part of operation.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: L056 instructs the agent to load multiple files under `~/.claude-marketing/brands/{slug}/guidelines/`, including restrictions, messaging, and voice documents. These are potentially sensitive internal materials, but the markdown lacks an explicit user warning that such local files will be read and used automatically.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: 8. **If no brand exists**, say: "No brand profile found. Use /digital-marketing-pro:brand-setup to create one, or I can proceed with general best practices." 9. **Check brand guidelines** — If `~/.claude-marketing/brands/{slug}/guidelines/_manifest.json` exists, load and enforce: `restrictions.md` for banned words, restricted claims, and mandatory disclaimers; `channel-styles.md` for channel-specific tone overrides (may differ from base voice); `messaging.md` for approved key messages, taglines, and positioning language; `voice-and-tone.md` for detailed voice rules beyond the 4 numeric scores. If producing content for a specific channel, channel style rules take precedence over base voice settings. Do not ask the user for information that already exists in their brand profile. ## Required Context
Confidence: 80% confidence
Finding: Do not ask the user

Session Persistence

Medium

Category: Rogue Agent
Content: **Official Google guidance on AI search optimization** (updated 15 May 2026 — [Google AI Optimization Guide](https://developers.google.com/search/docs/fundamentals/ai-optimization-guide)): - **No `llms.txt` file is needed.** Google's official position: "You don't need to create new machine readable files, AI text files, markup, or Markdown to appear in generative AI search." Do not waste time generating `llms.txt` for Google AI Features. (Other AI search engines may or may not consume it; current Anthropic / OpenAI / Perplexity public positions are also that they do not require it. Document any client pressure to ship `llms.txt` as a low-priority deliverable with no measurable upside.) - **No special AI-specific schema is needed.** "Structured data isn't required for generative AI search, and there's no special schema.org markup you need to add." Schema continues to matter for classic SEO and rich results. - **Eligibility is standard Search.** "To be eligible to be shown in generative AI features on Google Search, a page must be indexed and eligible to be shown in Google Search with a snippet, fulfilling the Search technical requirements."
Confidence: 60% confidence
Finding: create new machine readable files, AI text files, markup, or Markdown to appear in generative AI search." Do not waste time generating `llms.txt` for Google AI Features. (Other AI search engines may o

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill explicitly invokes `/usage --since 7d` and aggregates per-brand Claude Code token consumption and USD cost into a leadership dashboard, even though the stated purpose is campaign and portfolio health. This expands data access into billing and developer/workspace activity telemetry across client directories without necessity, creating a privacy and confidentiality risk if users are shown sensitive cost patterns or workspace attribution they did not intend to disclose.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill aggregates `/usage` output per working directory and maps it to brands, then reports model-level token totals and USD cost without any user-facing warning or consent flow. Because this can reveal sensitive billing information, internal activity patterns, and workspace attribution across multiple client accounts, the lack of transparency and permission gating makes the data exposure more dangerous in this multi-client agency context.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill instructs the agent to execute a local Python command against brand-specific campaign history before planning work. That expands the skill from analytics guidance into local tool execution and data access, which can expose sensitive local state or trigger unintended actions if the command or brand slug is manipulated. In this context, the danger is increased because the command is framed as a routine prerequisite, making autonomous execution more likely.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger list includes generic terms like 'metrics,' 'reporting,' 'performance,' and 'ROI,' which are common in many unrelated conversations. Overbroad activation can cause the wrong skill to engage and inherit its file-access and workflow instructions, increasing the chance of unnecessary sensitive-context reads or irrelevant autonomous behavior. The impact is limited but real because this skill contains instructions to inspect local brand/profile files.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document explicitly recommends intercepting clipboard writes and appending tracking parameters to shared URLs, which modifies user sharing behavior for attribution purposes without mentioning consent, notice, or privacy controls. In a marketing analytics skill, this is contextually plausible and likely not malicious, but it can create undisclosed user tracking, unexpected data collection, and privacy/compliance exposure if implemented as written.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Recommending 'server-side backup measurement' for non-consented users is dangerous because it can be interpreted as preserving tracking despite a user's denial of consent, undermining privacy controls and potentially violating GDPR/ePrivacy expectations. In an analytics skill, this is more dangerous because it normalizes implementation guidance that could be operationalized directly by teams without legal review.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document gives detailed instructions for transmitting hashed first-party identifiers and click IDs to ad platforms, but hashing does not make the sharing anonymous because these values remain linkable identifiers for cross-platform matching. Without a strong warning that such transfers are third-party data sharing requiring consent, contractual controls, and jurisdiction-specific compliance, implementers may deploy invasive tracking that exposes users to profiling and the organization to regulatory risk.

Session Persistence

Medium

Category: Rogue Agent
Content: 5. **Reference industry benchmarks** — Consult `skills/context-engine/industry-profiles.md` for the brand's industry 6. **Use platform specs** — Reference `skills/context-engine/platform-specs.md` for character limits and format requirements 7. **Check campaign history** — Run `python campaign-tracker.py --brand {slug} --action list-campaigns` before planning new work 8. **If no brand exists**, say: "No brand profile found. Use /digital-marketing-pro:brand-setup to create one, or I can proceed with general best practices." 9. **Check brand guidelines** — If `~/.claude-marketing/brands/{slug}/guidelines/_manifest.json` exists, load and enforce: `restrictions.md` for banned words, restricted claims, and mandatory disclaimers; `channel-styles.md` for channel-specific tone overrides (may differ from base voice); `messaging.md` for approved key messages, taglines, and positioning language; `voice-and-tone.md` for detailed voice rules beyond the 4 numeric scores. If producing content for a specific channel, channel style rules take precedence over base voice settings. Do not ask the user for information that already exists in their brand profile.
Confidence: 90% confidence
Finding: create one, or I can proceed with general best practices." 9. **Check brand guidelines** — If `~/.claude-marketing

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Content: ## The Privacy Landscape The era of unrestricted cross-site tracking is over. Safari and Firefox have blocked third-party cookies since 2020. Chrome has introduced significant restrictions through the Privacy Sandbox. Regulations like GDPR, CCPA/CPRA, and emerging state and international laws require explicit consent for tracking. Marketers who do not adapt their measurement infrastructure will lose visibility into 40-60% of their customer journey. ### What Has Changed
Confidence: 75% confidence
Finding: cookies since 2020. Chrome

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The skill is presented as an anomaly detection/reporting tool, but it also writes findings back into persistent storage via `campaign-tracker.py --action add-insight`. That side effect can surprise users, create durable records from potentially sensitive performance data, and alter future system behavior without explicit consent or a clearly disclosed write step.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs broad access to local brand files, agency SOPs, compliance documents, and all connected marketing platforms, but does not clearly warn the user about the scope of data collection and processing. This can lead to over-collection of sensitive business data and user surprise about how much local and remote information will be accessed during a single scan.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill persists critical and warning anomalies for future reference without explicitly notifying the user that results will be stored. Persistent storage of performance anomalies can expose commercially sensitive trends, create retention/privacy concerns, and affect later reports or automated workflows based on data the user did not realize would be saved.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs the agent to read multiple files from the user's home directory, including brand profiles, guidelines, templates, and SOPs, but the skill metadata and description do not warn the user that local files will be accessed. This creates a transparency and consent problem: users may invoke a marketing attribution skill without realizing it will inspect potentially sensitive local business data outside the immediate prompt context.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to read brand context from files in the user's home directory and later store attribution results for trend tracking, but it provides no user-facing warning, consent step, or description of what will be persisted. That creates a privacy and transparency risk because local files may contain sensitive business information and the saved analysis may retain marketing, revenue, or customer-journey data beyond the immediate task.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This section recommends ongoing voice-of-customer collection from support tickets, chat transcripts, sales recordings, reviews, and social mentions, but omits any guidance on consent, lawful basis, minimization, retention, or redaction of personal and potentially sensitive data. In a customer-research skill, that omission is materially risky because practitioners may operationalize broad data collection and analysis workflows without adding required privacy controls.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Recommending session recordings and heatmaps without warning about notice, consent, masking, and sensitive-field exclusion can lead users to deploy invasive tracking that captures user behavior, form inputs, or other personal data. In the context of an audience-intelligence skill, this is more dangerous because the content is framed as practical implementation guidance, increasing the likelihood of direct adoption.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly recommends behavioral inference, surveys, and social listening to build psychographic profiles, but it omits any privacy, consent, data-minimization, or legal-compliance guardrails. In a marketing research skill, that omission can lead users to collect inferred sensitive data or scrape social signals in ways that violate privacy expectations, platform rules, or regulations such as GDPR/CCPA.

VirusTotal

49/49 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/action-doctor.py:67
Evidence: _spec.loader.exec_module(_dss)

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/eval-runner.py:23
Evidence: run-quick Quick eval (hallucination + content quality + readability)

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/quality-tracker.py:152
Evidence: # Stamp the eval (include milliseconds to avoid collisions)

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/_helpers.py:22
Evidence: spec.loader.exec_module(module)

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_hermes_adapter.py:85
Evidence: spec.loader.exec_module(cls.module)

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: tests/test_hermes_edge_cases.py:32
Evidence: spec.loader.exec_module(module)

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: docs/integrations-guide.md:1686
Evidence: export HUBSPOT_ACCESS_TOKEN="[REDACTED]"