popup-cro
Verdict safe, but 1 finding (1 medium), mainly prompt injection. Most recent scan 2026-02-07.
The popup-cro skill is a conversion rate optimization assistant focused on popup and modal design guidance. The skill appears to be primarily instructional/advisory with no executable scripts. The main security concern is MEDIUM severity: the skill instructs the agent to read and trust external content from `.claude/product-marketing-context.md` without validation, creating a transitive trust vulnerability (AITech-1.2). An attacker who controls this external file could inject malicious instructions that the agent would follow. Additionally, there is a LOW severity issue with a missing referenced file (corner.py) that could indicate incomplete packaging or potential tool shadowing risk. The skill also lacks optional metadata fields (LOW severity, informational). No data exfiltration, command injection, or direct prompt injection threats were detected. The skill's core functionality - providing CRO advice for popups - appears legitimate and matches its description.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
When the user wants to create or optimize popups, modals, overlays, slide-ins, or banners for conversion purposes. Also use when the user mentions "exit intent," "popup conversions," "modal optimization," "lead capture popup," "email popup," "announcement banner," or "overlay." For forms outside of popups, see form-cro. For general page conversion optimization, see page-cro.
- Package
- 1 file, 11 KB
- SKILL.md
- 1679 words, 12+ sections
- Code
- None. Instructions only.
- Version
- 1.0.0
SKILL.md covers: Popup CRO · Initial Assessment · Core Principles · 1. Timing Is Everything · 2. Value Must Be Obvious · 3. Respect the User · Trigger Strategies · Time-Based · Scroll-Based · Exit Intent · Click-Triggered · Page Count / Session-Based
Findings
MEDIUM Transitive Trust Abuse via External Product Marketing Context File Prompt Injectionllm
The skill instructions direct the agent to read and trust content from `.claude/product-marketing-context.md` without validation. This file is external to the skill package and could contain malicious instructions that the agent would follow. The instruction 'read it before asking questions. Use that context' creates a transitive trust relationship where untrusted external content can influence agent behavior.
SKILL.md
If `.claude/product-marketing-context.md` exists, read it before asking questions. Use that context and only ask for information not already covered or specific to this task.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 11 KB |
Package contents recorded 2026-10-22 at commit a04cb61a577a. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/coreyhaines31/marketingskills
- Raw scan result: popup-cro-scan.json
- Badge for your README:
- Request a re-scan