Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only ecommerce advice skill with no hidden execution, persistence, or credential access, though users should review marketing and platform-compliance advice before applying it.
Install only if you want ecommerce operating-playbook guidance. Before using its email, SMS, advertising, or marketplace-migration recommendations in production, verify consent, opt-out handling, platform terms, and applicable marketing/privacy laws.
The quick-start phrase "Build my email flows" is broad, imperative, and plausible as a normal user request outside the narrow context of explicitly invoking this skill. That increases the chance of accidental activation or overlap with unrelated agent interactions, which can cause the agent to apply this skill inappropriately and produce unintended operational advice or workflow changes.
The skill provides detailed email/SMS automation guidance driven by customer behavior and outreach timing, but does not prominently require consent, lawful basis, opt-out handling, or jurisdiction-specific compliance checks. This can lead users to deploy campaigns that violate privacy, anti-spam, or telecom marketing rules, especially across GDPR/CCPA/TCPA/CAN-SPAM contexts.
The recommendation to build an email list from marketplace customers via package inserts and then drive them to DTC creates policy and privacy risk because many marketplaces restrict using order relationships to divert customers off-platform or reuse customer data for external marketing. In context, this is more dangerous than generic ecommerce advice because it explicitly operationalizes cross-channel migration from marketplace-origin customers without warning about platform terms or consent requirements.
The natural-language commands are very broad and provide no activation boundaries, confirmation requirements, or examples of out-of-scope requests. In an agent setting, this increases the chance the skill is invoked on ambiguous prompts and performs business, compliance, or marketing actions without sufficient user intent validation.
