{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-09","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"provisional","auth_posture":"auth_required","catalog_reconciliation":{"basis":"Documented actions on the identified catalog surface; not an execution test.","confidence":"medium","evidence_completeness":"partial","previous":{"confidence":"low","detail_sha256":"a4705b946cf338e69edea025f8c491ce2d7daeac2c0c61ef5b500a3646287c8d","risk":"medium"},"proposal_file":"parent-proposals.json","rationale":"First pass Low retained. The Medium came from the manual review's uncertainty about generate_campaign. The publisher's intelligence page calls the connection 'read-only and one-way', describes the assistant pulling ad-market intelligence, and says SpotsNow does not access the customer's proprietary data. No booking, launch or spend is described. The 'reads_private_data' card is a mislabel: the data is the vendor's licensed market intelligence, not the user's private data. The remaining gap (exact generate_campaign schema) is minor given the explicit read-only statement. Confidence is not high because no per-tool schema was read.","review_key":"claudesec:827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86","reviewed_at":"2026-10-12","runtime_verified":false,"sources":["https://spotsnow.io/intelligence","catalog-rating-review-2026-10-12/batches/batch-002.jsonl"],"status":"resolved"},"category":"Web Connector","confidence":"low","description":"Spotsnow researches podcast advertising and market opportunities. Inspect shows, hosts, advertisers, spend context, and sponsorship histories. Find audience matches, similar shows, or prospect brands through authenticated tools.","did":"827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86","documentation_url":"https://spotsnow.io/intelligence","editorial_description":{"extended_description":"Explore network prospects, ad fill rates, and industry context while generating campaign material.","schema_version":1,"summary":"Spotsnow researches podcast advertising and market opportunities.\nInspect shows, hosts, advertisers, spend context, and sponsorship histories.\nFind audience matches, similar shows, or prospect brands through authenticated tools."},"homepage_url":"","icon":"https://spotsnow.io/logo.png","id":"827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86","installs":0,"last_scanned":"","license":"","long_description":"Explore network prospects, ad fill rates, and industry context while generating campaign material.","manual_assessment":"unassessed","manual_review":{"all_findings":[{"evidence":"The tools retrieve brand spend/history, show inventory, fill rates and prospect intelligence.","reasoning":"This is subscription/private market data.","risk_type":"private_data_read","severity":"low","title":"Reads proprietary podcast advertising intelligence","triggering_tools_or_skills":["get_brand_details","get_brand_sponsored_shows","get_podcast_advertising_brands","get_bulk_podcasts_fill_rate","get_network_prospect_brands"]},{"evidence":"The tool name says generate_campaign, but the listing does not say whether it only returns a plan or persists/launches a campaign.","reasoning":"Missing tool schema prevents a verified write or launch classification.","risk_type":"evidence_gap","severity":"low","title":"Campaign generation behavior is ambiguous","triggering_tools_or_skills":["generate_campaign"]}],"assessment_status":"provisional","auth_and_scopes":"Authentication to Spotsnow is required; podcast/brand intelligence access is scoped to the account, but generate_campaign behavior and persistence are not documented.","blocked_missing_evidence":"Official tool description/input schema for generate_campaign stating whether it only returns analysis or creates/launches/persists a campaign, plus its authorization and spend behavior.","confidence":"low","displayed_risk":"medium","evidence_completeness":"partial","manual_overall_risk":"unassessed","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86.json","what_it_proves":"Candidate PR #125 record identity (name \"Spotsnow\", publisher, type web_connector) and 16 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86: complete tool_names inventory (16 tools), remote streamable-http endpoint https://backend.spotsnow.io/mcp-pro, auth_posture auth_required, directory tier community"}],"primary_reason":"Most Spotsnow tools are read-only intelligence, but generate_campaign has undocumented side effects.","provisional_risk":"medium","publication_recommendation":"fix","requires_runtime_verification":true,"review_key":"claude:827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed all 16 tools. An official publisher-domain lookup did not yield a tool reference; no send, buy, budget, publish or update name otherwise appears.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"unknown","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"true","prompt_injection_exposure":"true","provenance_uncertainty":"true","reads_private_data":"true","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":16,"tools_or_skills_total":16},"name":"Spotsnow","needs_runtime_verification":true,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://spotsnow.io/privacy","provisional_risk":"medium","publication_recommendation":"fix","publisher":"spotsnow","publisher_url":"https://spotsnow.io/","remote_url":"https://backend.spotsnow.io/mcp-pro","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"Spotsnow provides podcast and brand advertising intelligence through a documented read-only connection. It does not access the customer’s proprietary datasets through this connection.","evidence":"https://spotsnow.io/intelligence\ncapability groups; 'read-only and one-way'","risk_type":"reads_public_data","severity":"low","title":"Reads advertising market intelligence"}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"support@spotsnow.io","tags":["reads_public_data"],"tools":[{"description":"","name":"discover_ad_inventories"},{"description":"","name":"find_podcasts_by_audience_description"},{"description":"","name":"generate_campaign"},{"description":"","name":"get_batch_lookalike_shows"},{"description":"","name":"get_brand_details"},{"description":"","name":"get_brand_sponsored_shows"},{"description":"","name":"get_bulk_podcasts_fill_rate"},{"description":"","name":"get_industry_details"},{"description":"","name":"get_network_podcasts"},{"description":"","name":"get_network_prospect_brands"},{"description":"","name":"get_new_performing_podcasts"},{"description":"","name":"get_podcast_advertising_brands"},{"description":"","name":"get_podcast_details"},{"description":"","name":"get_reference_brand_prospect_shows"},{"description":"","name":"list_classifications"},{"description":"","name":"resolve_entity_ids"}],"tools_count":16,"transport":"streamable-http","type":"web_connector","url":"https://claude.ai/directory/827fbc77-5ae0-4c0b-9f12-9b5c3ef19f86","uuid":"c3434fef-4f58-5fe2-957d-969fb029ecd9","verification_tier":"community","version":""},"query_key":"spotsnow spotsnow","schema_version":1,"status":"match"}