Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed marketing performance-analysis template package, but users should be careful with its ROI guidance and saved memory notes.
Install only if you are comfortable with campaign analytics being summarized into memory. Treat ROI, revenue, CPA, and budget recommendations as draft business analysis, and use the dedicated ROI calculator or your own finance workflow before acting on dollar-level conclusions.
L006 states the skill is 'Not for dollar-level return math,' which sets a clear documentation constraint. Yet L071 instructs ranking creators on ROI, and the example at L093-L097 reports revenue, ROI, and budget-shift recommendations based on ROI. That is an active contradiction in the documentation about what the skill is supposed to do.
The manifest description at L006 explicitly limits scope by saying 'Not for dollar-level return math — use roi-calculator.' However, the skill body broadens behavior: L018 says it analyzes performance beyond surface metrics and L020 repurposes it as a cross-channel paid-ads scorecard/anomaly lens. More importantly, later instructions and examples include revenue and ROI-based ranking, which conflicts with the stated scope boundary.
The skill instructs writing analysis artifacts and promoting 'durable facts' into shared memory without an explicit consent or confirmation step. In agent environments with persistent shared state, this can cause unauthorized data retention, contamination of future runs, and leakage of sensitive campaign or business information across tasks.
The skill references using a YouTube API key and pulling measured platform metrics, but it does not clearly disclose credential use, data-access scope, or whether account/campaign data may be sent through an external connector. In practice, this can lead to users unintentionally authorizing access to sensitive analytics or exposing API-backed data flows they did not expect.
The template explicitly includes ROI columns in the influencer ranking section, which contradicts the skill's declared boundary of not performing dollar-level return math. This can cause the agent to exceed its authorized scope, produce unsupported financial analysis, and misroute users away from the dedicated roi-calculator skill intended for this higher-risk calculation domain.
The conversion analysis section requires revenue, cost-per-click, cost-per-conversion, and attribution revenue calculations, all of which are forms of dollar-level return analysis excluded by the skill contract. If used as-is, the skill may generate financial conclusions from incomplete or unvalidated data, increasing the risk of incorrect business decisions and violating separation-of-duties between skills.
The worked example normalizes ROI benchmarking and budget-shift recommendations based on ROI, directly teaching the agent to perform the very financial reasoning the manifest forbids. Examples are especially influential in LLM behavior, so this increases the likelihood of systematic scope drift and financially sensitive outputs in routine use.
No suspicious patterns detected.
