Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for Zola wedding management, but it gives an agent broad read/write authority over sensitive wedding-planning records without clear confirmation or scoping controls.
Install only if you intend to let an agent work with your Zola wedding data. Treat guest addresses, RSVPs, invitations, budget, vendors, registry, and gift tracking as sensitive, and require explicit review before any add, update, remove, invite, seating, budget, or bulk event change.
The trigger text is broad enough to match many generic wedding-planning requests, which can cause the skill to activate when the user did not explicitly intend to access Zola data. Because this skill exposes numerous read/write operations over sensitive personal and event data, unintended invocation increases the chance of privacy leakage or accidental modification.
The skill advertises many mutating capabilities across guests, vendors, seating, events, and budget data but provides no warning that these actions can change sensitive wedding-planning records. In practice, this can lead users or calling agents to perform destructive or privacy-impacting actions without clear notice, especially given access to guest lists, addresses, RSVP status, and registry information.
No suspicious patterns detected.
