paywall-upgrade-cro

================================================================================

🔵 VERDICT: LOW

This skill is largely instructional and descriptive, focusing on best practices for paywall and upgrade screen optimization. It does not contain any direct executable commands, external network requests, or obfuscated content. The primary security finding is a low-severity risk related to local file access.

Total Findings: 2

🔵 LOW Findings: • File System Access (Read)

• Line 17 (SKILL.md): If .claude/product-marketing-context.md exists, read it before asking questions.
• This instruction directs the AI to read a local file for context. While the file name product-marketing-context.md suggests benign content, any capability to read local files introduces a potential, indirect risk. In this specific case, there are no commands to exfiltrate the content of this file, nor is the file path inherently sensitive.

ℹ️ INFO Findings: • Indirect Prompt Injection Risk

• Line 17 (SKILL.md): If .claude/product-marketing-context.md exists, read it before asking questions.
• The instruction to read a local file means the skill processes external content. If the content of .claude/product-marketing-context.md were user-controlled or maliciously crafted, it could potentially lead to indirect prompt injection, influencing the AI's behavior. This is a general risk for skills that process external data.

================================================================================