Security audit
Security checks for vulnerabilities and agentic risk
This is a payroll guidance skill with broad activation terms, but its behavior is disclosed, text-only, and aligned with helping small businesses handle payroll tasks.
Before installing, understand that this skill may be invoked by common payroll terms and may ask for sensitive employee or tax details. Use it for guidance and calculations, but verify jurisdiction-specific payroll, tax, and legal obligations with official sources or a qualified professional before acting.
The trigger list contains broad natural-language phrases such as "payroll," "W-2," and "pay employees" that are likely to appear in ordinary business conversations. This can cause unintended skill activation and route sensitive payroll or HR discussions into this skill when the user did not explicitly intend to invoke it.
The skill description is very broad and lacks clear activation boundaries, so an agent may invoke it for a wide range of loosely related business, HR, tax, or compliance questions. That increases the chance of inappropriate routing and over-trust in the skill’s guidance for regulated payroll matters, where jurisdiction-specific mistakes can create legal and financial harm.
The phrase "Anyone who has received a payroll tax notice and needs to understand it" is broad and, alongside the general trigger design, suggests wide applicability without explicit activation constraints. In a manifest, lack of specificity about when the skill should or should not activate increases the risk of unintended matching.
No suspicious patterns detected.
