Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only customer-support skill whose sensitive data use is apparent from its support purpose, with no code, install actions, hidden execution, or persistence mechanism found.
Install only where customer-support data may be processed by the agent. Redact unnecessary personal, billing, security, or account details when possible, and require human review before sending customer replies, changing queue priorities, escalating externally, or retaining ticket history in a knowledge base.
The skill metadata describes a very broad customer-support capability without clear trigger boundaries, scope limits, or constraints on when it should activate. In an agent environment, this can cause over-invocation, unnecessary access to support artifacts, and unintended handling of sensitive customer workflows, increasing the chance of privacy, authorization, or operational mistakes.
The skill explicitly states it reads full tickets, account history, and contextual customer information, but it provides no warning about the presence of sensitive or personal data in those sources. This creates a real privacy and data-governance risk because users may invoke the skill without understanding that it may process account details, historical correspondence, and other potentially regulated information.
