Security audit
Security checks for vulnerabilities and agentic risk
This salon skill is a plain Markdown assistant guide with expected salon workflows and no executable or hidden behavior, though it should tighten privacy and activation guidance before real use.
Before installing for production use, narrow the trigger text to explicit salon tasks and add a privacy note covering what client data is collected, why, who can access it, and how long it is retained. Replace placeholder services, prices, currency, policies, staff names, and booking contact details with the salon's real local information.
The trigger scope is excessively broad: it says to use the skill for anything related to a beauty salon, even loosely. That increases the chance the skill is invoked in ordinary conversations where it is unnecessary, causing misrouting, over-collection of user details, and unintended application of salon-specific workflows to unrelated contexts.
The skill instructs collection of full name, contact number, allergies, and consultation details without any privacy notice, consent step, retention guidance, or minimization rule. In a salon context this creates real risk of unnecessary collection and mishandling of personal and potentially sensitive health-related information during routine interactions.
The consultation logic defines budget ranges only in Indian rupees, which imposes a specific locale assumption in the user interaction. The file does not indicate that the skill is intended only for an India-specific business context or provide any opt-in or alternative locale handling.
The note states that currency is shown as ₹ (INR) and should be changed to the local currency, which imposes a locale-specific default in the content. Under the policy, forcing a specific locale without user opt-in can be a natural-language policy concern when no region-specific scope is documented for the skill.
No suspicious patterns detected.
