Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed psychology and marketing guidance package with local-only helper scripts and no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Install this if you want psychology, learning-design, UX, and ethical conversion guidance. Treat persuasion and profiling outputs as human-reviewed advice, avoid using it for covert psychological profiling or manipulative design, and do not rely on it for medical, psychiatric, crisis, legal, or major financial advice.
The declared purpose is psychology guidance, but the file also instructs use of local scripts for searching files and auditing content, introducing generic filesystem/CLI behavior not clearly justified by the stated function. That mismatch can hide operational capabilities from reviewers and users, increasing the risk of unauthorized file enumeration or data access under the guise of a benign expert skill.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| **Distancing** | Psychological distance | "How will I view this in 5 years?" |
| **Normalizing** | Common experience | "Everyone struggles with this" |
| **Benefit finding** | Find positive | "What can I learn?" |
| **Acceptance** | Allow without judgment | "This is uncomfortable, and that's okay" |
### Emotional Granularity
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
| **Distancing** | Psychological distance | "How will I view this in 5 years?" |
| **Normalizing** | Common experience | "Everyone struggles with this" |
| **Benefit finding** | Find positive | "What can I learn?" |
| **Acceptance** | Allow without judgment | "This is uncomfortable, and that's okay" |
### Emotional Granularity
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
### 🎓 Education & Learning
- Design optimal curricula for different age groups
- Create effective study schedules based on memory science
- Build motivation systems that don't rely on extrinsic rewards
### 📈 Marketing & Growth
The skill advertises executable/script-based capabilities and reference-file access but does not declare any explicit tool scope or permission boundary. That creates ambiguity about what files may be read and encourages broader-than-necessary filesystem access if an agent auto-enables file tools, which can expose unintended local data.
The trigger list includes general phrases such as "Understand customer decision-making process," "Build habit-forming product experience," and "Behavioral analysis for [user segment]," which could match many ordinary business requests. The file does not provide exclusion conditions or a narrower invocation scope to clarify when this skill should activate instead of other general strategy or UX skills.
The section explicitly presents cognitive biases with 'Marketing/UX Application' guidance such as anchoring, loss aversion, defaults, social proof, scarcity, and framing, which can be used to steer user decisions without meaningful consent or adequate safeguards. In a skill framed around conversion psychology and persuasive messaging, this moves beyond neutral education and creates a realistic risk of manipulative dark-pattern design that undermines user autonomy and informed choice.
The document includes gendered color guidance such as associating pink with femininity and using it for beauty, romance, and children without qualification or cultural/contextual caveats. In a psychology and marketing skill, this can reinforce stereotypes, lead to discriminatory or exclusionary design decisions, and present biased heuristics as evidence-based guidance.
The section recommends inferring personality from behavior, purchase history, engagement patterns, and social media activity, but only warns against manipulation. It does not address informed consent, lawful basis, data minimization, profiling sensitivity, or privacy risks, which can enable invasive psychological profiling and downstream misuse in targeting or persuasion.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| "Trick customers into..." | Decline, explain ethical persuasion |
| "Make addictive..." | Decline, discuss ethical engagement |
| "Target vulnerable..." | Decline, protect populations |
| "Bypass consent..." | Decline, explain consent importance |
| "Diagnose my..." | Refer to professional |
| "Therapy for..." | Refer to licensed therapist |
The file includes a dedicated "english" skill framework and CLI help that presents English as a built-in target, but there is no natural-language indication that this language choice is optional or contextually required. This can violate language/locale policy expectations when a skill appears to privilege a specific language without explicit user opt-in or justification.
The README presents "Improve our signup funnel conversion" as a user invocation example, but it does not define any narrower activation scope, exclusion conditions, or specific trigger set. Because this is a broad natural-language request that could appear in ordinary conversation, it risks unintended invocation in systems that derive activation cues from README examples.
Line L081 states that language should be kept at a '6th-8th grade reading level' as a general rule. This is a natural-language instruction that enforces a specific language/communication constraint without indicating user opt-in, audience choice, or context-specific justification.
The section states broad normative claims such as grammar acquisition being most efficient before age 7 and accent acquisition being best before age 12. This is natural-language guidance tied to age and language learning context, but it does not offer any user choice, contextual qualification, or note that such guidance may vary by learner and language situation.
The document provides a structured catalog of persuasion and negotiation tactics such as anchoring, scarcity, commitment escalation, social proof, and power asymmetry handling, but offers only minimal ethical framing and no clear warning about misuse, manipulation, or relational harm. In a psychology-focused skill, this increases the likelihood that users will apply these techniques to influence others in ways that are deceptive, coercive, or unfair, especially because the content is presented as practical guidance rather than critical analysis.
The content explicitly maps neuropsychology concepts to engagement and conversion tactics, including variable reward, urgency, loss framing, and reward anticipation, but provides no warning, constraints, or ethical boundaries. In a skill positioned for psychology, marketing, and conversion optimization, this can enable manipulative behavioral design that exploits cognitive biases and reward systems rather than supporting informed user choice.
This section gives concrete persuasion tactics such as foot-in-the-door, door-in-the-face, and cognitive dissonance applications, including direct marketing uses, without a clear overarching warning or boundary against manipulative deployment. In a skill explicitly positioned for optimization, conversion, and persuasive messaging, this materially increases the chance the content is used to influence users in ways that undermine autonomy or exploit cognitive biases.
No suspicious patterns detected.