Skip to content
skillsafebeta
← Report library
Purpose / Documents

Lead Magnets Skill Security Audit

What the author says it does (original text)

When the user wants to create, plan, or optimize a lead magnet for email capture or lead generation. Also use when the user mentions "lead magnet," "gated content," "content upgrade," "downloadable," "ebook," "cheat sheet," "checklist," "template download," "opt-in," "freebie," "PDF download," "resource library," "content offer," "email capture content," "Notion template," "spreadsheet template,"

Independent security check

Security risks found

Files checked
4
Risks found
4
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 2
Medium risk

Product-marketing context is read automatically and can influence output

Source references: 1
What we found

The Skill explicitly requires reading one of three conventional product-marketing files first. Such files may contain non-public customer profiles, positioning, metrics, or plans, while the instruction does not separate publishable material from confidential material.

Why this matters

If an outside collaborator initiates the request or the result enters a shared document, internal strategy could be quoted, summarized, or indirectly revealed.

What this evidence establishes

The Skill does require reading and using product-marketing material from predefined paths, so internal customer, positioning, or metric data could influence an answer. However, it does not instruct the model to disclose, upload, or publish that material, and the access is relevant to the planning task. Risk depends on whether those files contain secrets and whether outputs repeat them. Users can restrict access to these paths or require confirmation and sensitive-data filtering.

This assessment concerns the code and conditions shown, not proof that harm has occurred.
SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.
Medium risk

The strategy collects and reuses lead data without requiring privacy notice or consent

Source references: 6
What we found

The Skill recommends collecting email, name, company, and role, starting an email relationship, and tailoring follow-ups by quiz result. This is a concrete workflow for ongoing processing of personal and professional data. Its instructions focus on conversion friction but do not require purpose disclosure, retention limits, unsubscribe handling, or applicable marketing consent.

Why this matters

Deploying it as written could produce unexpected marketing contact, excessive profiling, privacy complaints, email-platform penalties, or regulatory exposure.

The Skill recommends collecting email and workplace identity fields, delivering content by email, and tailoring follow-ups from quiz results. A real deployment would therefore process identifiable contact data. Although sample copy mentions unsubscribing, the instructions do not require disclosure of purpose, consent basis, retention, or sharing before collection. Users can require explicit privacy notice, marketing consent, unsubscribe handling, retention limits, and only necessary fields.

SKILL.md:136In the instructionsOpen original file
- **Email only** — highest conversion, lowest friction- **Email + name** — enables personalization, slight friction increase- **Email + company/role** — better lead qualification, more friction- **Multi-field** — only for high-value offers (webinars, demos)Rule of thumb: Ask for the minimum needed. Every extra field reduces conversion by 5-10%.
Show 5 other places
SKILL.md:172In the instructionsOpen original file
|--------|------|------|| **Instant download** | Immediate gratification | No email verification || **Email delivery** | Verifies email, starts relationship | Slight delay || **Thank you page + email** | Best of both—instant access + email copy | Slightly more complex || **Drip delivery** | Builds habit, multiple touchpoints | Only for courses/series |
references/format-guide.md:166In the instructionsOpen original file
**Result Segmentation**:- 3-5 result categories- Each result: name, description, personalized recommendations- Tailor follow-up emails by result type- Share-worthy result format ("I got: Growth Stage Marketer!")**Implementation**: Gate results behind email capture. The quiz itself is ungated — the personalized results require an email.
SKILL.md:134In the instructionsOpen original file
### What to Ask For- **Email only** — highest conversion, lowest friction- **Email + name** — enables personalization, slight friction increase- **Email + company/role** — better lead qualification, more friction- **Multi-field** — only for high-value offers (webinars, demos)Rule of thumb: Ask for the minimum needed. Every extra field reduces conversion by 5-10%.
SKILL.md:168In the instructionsOpen original file
### Delivery Methods| Method | Pros | Cons ||--------|------|------|| **Instant download** | Immediate gratification | No email verification || **Email delivery** | Verifies email, starts relationship | Slight delay || **Thank you page + email** | Best of both—instant access + email copy | Slightly more complex || **Drip delivery** | Builds habit, multiple touchpoints | Only for courses/series |
SKILL.md:145In the instructionsOpen original file
- Make the value obvious: "Get the full 25-page guide free"- Show a preview: table of contents, first page, sample results- Add social proof: "Downloaded by 5,000+ marketers"- Reduce risk: "No spam. Unsubscribe anytime."
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

The example can encourage unverified download-count social proof

Source references: 1
What we found

The Skill directly lists “Downloaded by 5,000+ marketers” as social proof to add, without requiring verification or identifying the number as a placeholder.

Why this matters

If copied without matching download records, the landing page would make a false marketing claim, potentially harming customer trust and creating advertising-platform, consumer-protection, or contractual risk.

“Downloaded by 5,000+ marketers” is marketing-copy guidance, not a claim that a particular product actually has that count. Still, it is presented directly as social proof to add, without saying it is a placeholder or must be verified. If copied into a live page, the user could publish a misleading claim and damage customer trust. Users can require documented verification for every numerical proof claim or use truthful non-numerical proof.

SKILL.md:143In the instructionsOpen original file
### How to Frame the Exchange- Make the value obvious: "Get the full 25-page guide free"- Show a preview: table of contents, first page, sample results- Add social proof: "Downloaded by 5,000+ marketers"- Reduce risk: "No spam. Unsubscribe anytime."
Low risk

Conversion, cost, and per-field impact figures are not sourced

Source references: 6
What we found

The Skill supplies specific industry conversion rates, channel costs, and a “5–10% per extra field” figure without a source, sample, date, or measurement definition. The reference file ultimately acknowledges that its benchmarks are only general guidance.

Why this matters

Treating these numbers as promises or reliable industry baselines could lead to unrealistic targets, incorrect campaign evaluation, or misallocated paid-media budgets.

The source supplies specific ranges for per-field conversion loss, industry conversion rates, and acquisition costs without research sources, dates, samples, or measurement definitions. The reference file calls them general guidelines, which reduces certainty, but the main Skill may still lead users to treat them as reliable budgeting or form-design benchmarks. Users can ask for dated sources and treat the ranges only as hypotheses to validate against their own data.

SKILL.md:136In the instructionsOpen original file
- **Email only** — highest conversion, lowest friction- **Email + name** — enables personalization, slight friction increase- **Email + company/role** — better lead qualification, more friction- **Multi-field** — only for high-value offers (webinars, demos)Rule of thumb: Ask for the minimum needed. Every extra field reduces conversion by 5-10%.
Show 5 other places
SKILL.md:229In the instructionsOpen original file
| Metric | What It Tells You | Benchmark ||--------|-------------------|-----------|| **Landing page conversion rate** | Offer attractiveness | 20-40% (warm traffic), 5-15% (cold) || **Cost per lead** | Acquisition efficiency | Varies by channel and industry || **Lead-to-customer rate** | Lead quality | 1-5% (B2B), varies widely || **Email engagement** | Content relevance | 30-50% open, 2-5% click || **Time to conversion** | Nurture effectiveness | Track by lead magnet source |
references/benchmarks.md:80In the instructionsOpen original file
| Channel | Typical CPL | Notes ||---------|-------------|-------|| Organic search | $0-5 | Lowest, but slow to build || Blog content upgrade | $0-2 | Nearly free if you have traffic || Facebook/Instagram Ads | $3-15 | B2C lower, B2B higher || Google Ads | $10-50 | High intent, higher cost || LinkedIn Ads | $25-75 | B2B, expensive but qualified || Partner co-promotion | $0-5 | Depends on relationship |
references/benchmarks.md:129In the instructionsOpen original file
**Note**: These benchmarks are general guidelines. Your actual results depend on audience, niche, traffic volume, and offer quality. Start measuring from day one and build your own benchmarks.
references/benchmarks.md:33In the instructionsOpen original file
### By Industry (Landing Page)| Industry | Average Conversion ||----------|-------------------|| SaaS/Tech | 15-25% || Marketing/Agency | 20-35% || Finance | 10-20% || E-commerce | 10-20% || Education | 20-35% || Health/Wellness | 15-25% |
references/benchmarks.md:78In the instructionsOpen original file
### Cost Per Lead by Channel| Channel | Typical CPL | Notes ||---------|-------------|-------|| Organic search | $0-5 | Lowest, but slow to build || Blog content upgrade | $0-2 | Nearly free if you have traffic || Facebook/Instagram Ads | $3-15 | B2C lower, B2B higher || Google Ads | $10-50 | High intent, higher cost || LinkedIn Ads | $25-75 | B2B, expensive but qualified || Partner co-promotion | $0-5 | Depends on relationship |

Inside this skill

8 instruction sections

This is a marketing-strategy guidance Skill that produces plans for lead-magnet content, forms, distribution, and measurement. The complete supplied source contains no scripts, installation commands, credential requests, or direct network calls.

View source
SKILL.md:260In the instructionsOpen original file
When creating a lead magnet strategy, provide:### 1. Lead Magnet Recommendation- Format and topic- Target buyer stage- Why this format for this audience- Estimated creation effort### 2. Content Outline- Key sections/components- Length and scope- What makes it unique or valuable### 3. Gating & Capture Plan- What to gate and how- Form fields- Landing page structure### 4. Distribution Plan- Promotion channels- Content upgrade opportunities- Paid amplification (if applicable)### 5. Measurement Plan- KPIs and targets- What to A/B test first

At runtime, it first looks for and reads a product-marketing context file in the project, then uses that information to reduce questions and shape recommendations.

View source
SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

It recommends collecting email and optionally name, company, and role through forms, followed by email delivery, drip courses, and result-segmented follow-up marketing.

View source
SKILL.md:134In the instructionsOpen original file
### What to Ask For- **Email only** — highest conversion, lowest friction- **Email + name** — enables personalization, slight friction increase- **Email + company/role** — better lead qualification, more friction- **Multi-field** — only for high-value offers (webinars, demos)Rule of thumb: Ask for the minimum needed. Every extra field reduces conversion by 5-10%.
references/format-guide.md:166In the instructionsOpen original file
**Result Segmentation**:- 3-5 result categories- Each result: name, description, personalized recommendations- Tailor follow-up emails by result type- Share-worthy result format ("I got: Growth Stage Marketer!")**Implementation**: Gate results behind email capture. The quiz itself is ungated — the personalized results require an email.

The evaluation file contains test expectations rather than runtime implementation; it asks the model to repeat particular marketing judgments and figures but adds no execution capability.

View source
evals/evals.json:34In the instructionsOpen original file
      "id": 3,      "prompt": "Our lead form asks for name, email, company, role, company size, and phone. We're not getting enough signups. Could the form be the problem?",      "expected_output": "Should immediately flag form length as a likely culprit. Should cite the rule of thumb: every extra field reduces conversion 5-10%. Should recommend reducing to the minimum needed: ideally email only (highest conversion), or email + name if personalization matters. Should explain when multi-field is justified (only for high-value offers like webinars or demos). Should ask what information is actually used in follow-up — fields that aren't used should be removed. Should suggest progressive profiling: capture email now, ask for more fields later via enrichment or follow-up forms. Should reference cro skill for form optimization specifically.",      "assertions": [        "Flags form length as likely culprit",        "Cites 5-10% per field rule",        "Recommends reducing to email or email + name",        "Asks what fields are actually used",        "Suggests progressive profiling",        "Cross-references cro skill"      ],
Start here · InstructionsSKILL.md
lead-magnets
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 3 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/benchmarks.mdFull text included
  • references/format-guide.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/benchmarks.mdSupporting file
  • references/format-guide.mdSupporting file
Lines read
726
File checksum (to compare versions)
7514f1379881e3e121824414d7f638c7a563f1dc2abe18ef991530d95aa38ab3