Skip to content
skillsafebeta
← Report library
Purpose / Other

Free Tools Skill Security Audit

What the author says it does (original text)

When the user wants to plan, evaluate, or build a free tool for marketing purposes — lead generation, SEO value, or brand awareness. Also use when the user mentions "engineering as marketing," "free tool," "marketing tool," "calculator," "generator," "interactive tool," "lead gen tool," "build a tool for leads," "free resource," "ROI calculator," "grader tool," "audit tool," "should I build a free

Independent security check

Security risks found

Files checked
4
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Automatic project-file reading may place undisclosed business information into model context

Source references: 1
What we found

Before asking the user questions, the Skill directs the agent to locate and read one of three conventionally named marketing files. It does not first ask whether their contents are appropriate for agent processing or limit reading to fields needed for the task.

Why this matters

If a file contains unreleased positioning, customer profiles, budgets, competitive strategy, or other internal material, that information enters the agent's processing context and could be reflected in later answers. The source shows no additional network transfer, but the read still expands the data being processed.

This is an active instruction to check and read a product-marketing file before asking questions. Such a file could contain non-public strategy, audience, or budget information, while the instruction neither seeks consent nor limits reading to necessary sections. The risk arises only if the file exists and contains sensitive material; the evidence does not show that it was read or disclosed. Users can ask for consent-first access, field-level minimization, and clear model/data-handling boundaries.

SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
Medium risk

Lead capture collects email addresses without specifying consent, purpose, retention, or recipient

Source references: 2
What we found

The Skill calls “Email only” a low-friction best practice and treats email collection and lead delivery as an MVP requirement, but does not also require disclosure of marketing use, consent, retention limits, opt-out handling, or access controls for the destination system.

Why this matters

If implemented as written, the tool may collect identifiable information for follow-up marketing without visitors understanding where it goes or how it will be used. This can create privacy complaints, unwanted outreach, and account or compliance risk.

The Skill presents email collection and routing leads somewhere as best practice and MVP functionality, but the visible guidance does not require purpose disclosure, marketing consent, opt-out, retention limits, or access controls for the lead system. If implemented as written, addresses could be used for marketing users did not clearly understand or stored in an inadequately governed system. This supports a design risk, not proof that data was collected. Users can require consent, notice, minimal retention, opt-out, and recipient-access rules.

SKILL.md:100In the instructionsOpen original file
### Lead Capture Best Practices- Value exchange clear: "Get your full report"- Minimal friction: Email only- Show preview of what they'll get- Optional: Segment by asking one qualifying question
Show 1 other places
SKILL.md:139In the instructionsOpen original file
### Minimum Viable Tool1. Core functionality only—does the one thing, works reliably2. Essential UX—clear input, obvious output, mobile works3. Basic lead capture—email collection, leads go somewhere useful
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

Uncited case-study figures are directed to justify budgets and set expectations

Source references: 3
What we found

The reference presents traffic, conversion, revenue, and acquisition-cost figures as real results and explicitly tells the agent to use them to justify a build. The supplied files provide no report names, links, dates, metric definitions, or calculation methods.

Why this matters

The figures cannot be verified from the supplied material and may combine different years, funnel definitions, and attribution methods. Treating them as benchmarks could overstate leads or revenue and distort engineering budgets, channel choices, or commercial commitments.

The reference labels traffic, conversion, revenue, and CAC figures as real results and explicitly directs the agent to use them to set expectations and justify engineering investment. The supplied material gives no report, link, date, sample, or measurement method, so the figures cannot be verified here and may not generalize across tools. Using them for budget approval could mislead business decisions. Users can request a verifiable source, date, and methodology for each figure and require that cases not be presented as forecasts.

references/tool-benchmarks.md:3In the instructionsOpen original file
Real free tools and the numbers they produced. Use these to set expectations, justify the build, and pattern-match your concept against what actually worked.
Show 2 other places
references/tool-benchmarks.md:11In the instructionsOpen original file
| Tool | Company | Build cost | Result ||------|---------|-----------|--------|| Unsplash | Crew | 3 hrs, leftover redesign photos | 11M monthly visitors; acquired by Getty || Website Grader | HubSpot | 2 engineers, 2 weeks | 250K leads, 98% auto-qualification, $6M revenue || Forecasting | Baremetrics | — | 35% trial conversion || Headline Analyzer | CoSchedule | — | ~20% of users convert to subscribers || Keyword Explorer | Moz | — | 40% trial conversion, CAC down 65% || Salary Calculator | Buffer | — | 1.5M visitors, 12% signup rate || Hatchful | Shopify | — | 25% trial conversion |
references/tool-benchmarks.md:31In the instructionsOpen original file
## How to use these benchmarks- **Set expectations**: Analyzer/grader tools tend to convert visitors to leads well and qualify them; calculators skew toward reach and share-worthiness; generators feed onboarding.- **Justify the build**: Compare your expected lead value × volume against these ratios before committing engineering time.- **Pattern-match**: Find the case closest to your concept (adjacent-to-product vs pure-reach) and borrow its gating and distribution approach.

Inside this skill

8 instruction sections

This is an instruction-only marketing-strategy Skill. It guides the agent to understand the business, goals, and resources, then assess free tools for lead generation, SEO, brand value, and build feasibility. The supplied source contains no scripts, installation steps, or direct network operations.

View source
SKILL.md:10In the instructionsOpen original file
You are an expert in engineering-as-marketing strategy. Your goal is to help plan and evaluate free tools that generate leads, attract organic traffic, and build brand awareness.
SKILL.md:17In the instructionsOpen original file
Before designing a tool strategy, understand:1. **Business Context** - What's the core product? Who is the target audience? What problems do they have?2. **Goals** - Lead generation? SEO/traffic? Brand awareness? Product education?3. **Resources** - Technical capacity to build? Ongoing maintenance bandwidth? Budget for promotion?

It compares several tool formats and uses an eight-factor scorecard covering search demand, buyer fit, differentiation, product path, build feasibility, maintenance burden, link potential, and shareability.

View source
SKILL.md:53In the instructionsOpen original file
| Type | Examples | Best For ||------|----------|----------|| Calculators | ROI, savings, pricing estimators | Decisions involving numbers || Generators | Templates, policies, names | Creating something quickly || Analyzers | Website graders, SEO auditors | Evaluating existing work || Testers | Meta tag preview, speed tests | Checking if something works || Libraries | Icon sets, templates, snippets | Reference material || Interactive | Tutorials, playgrounds, quizzes | Learning/understanding |
SKILL.md:149In the instructionsOpen original file
## Evaluation ScorecardRate each factor 1-5:| Factor | Score ||--------|-------|| Search demand exists | ___ || Audience match to buyers | ___ || Uniqueness vs. existing | ___ || Natural path to product | ___ || Build feasibility | ___ || Maintenance burden (inverse) | ___ || Link-building potential | ___ || Share-worthiness | ___ |**25+**: Strong candidate | **15-24**: Promising | **<15**: Reconsider

It explicitly includes email collection and delivery of leads to a receiving destination in the tool design, while comparing fully gated, partially gated, and ungated approaches.

View source
SKILL.md:91In the instructionsOpen original file
### Gating Options| Approach | Pros | Cons ||----------|------|------|| Fully gated | Maximum capture | Lower usage || Partially gated | Balance of both | Common pattern || Ungated + optional | Maximum reach | Lower capture || Ungated entirely | Pure SEO/brand | No direct leads |### Lead Capture Best Practices- Value exchange clear: "Get your full report"- Minimal friction: Email only- Show preview of what they'll get- Optional: Segment by asking one qualifying question
SKILL.md:139In the instructionsOpen original file
### Minimum Viable Tool1. Core functionality only—does the one thing, works reliably2. Essential UX—clear input, obvious output, mobile works3. Basic lead capture—email collection, leads go somewhere useful
Start here · InstructionsSKILL.md
free-tools
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 4 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/tool-benchmarks.mdFull text included
  • references/tool-types.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/tool-benchmarks.mdSupporting file
  • references/tool-types.mdSupporting file
Lines read
549
File checksum (to compare versions)
1c7ea72f292a0ae55250287452b832bb0db554f4e852130397ba89348faa69cc