Security audit
Security checks for vulnerabilities and agentic risk
This is a plain Markdown guidance skill for SaaS churn prevention and payment recovery, with no hidden code or install-time behavior found.
Before installing, treat this as business-process guidance rather than legal or billing-system authority. Review any cancellation, payment retry, account pause, data retention, and deletion policies with the appropriate business and legal owners, especially for click-to-cancel, auto-renewal, and privacy requirements.
The description says to use the skill whenever a user wants to 'reduce churn' or 'implement retention strategies' and 'whenever someone is losing subscribers,' which are broad natural-language conditions rather than narrowly scoped triggers. This can overlap with general business, marketing, analytics, or product conversations and may cause unintended invocation.
The eval explicitly expects the skill to trigger on casual phrasing, which encourages broad and potentially imprecise activation. In an agent environment, overly broad routing can cause the churn-prevention skill to activate for loosely related retention or cancellation language, leading to incorrect tool/skill selection, reduced reliability, and possible bypass of more appropriate specialized skills.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Inform users about data retention period post-cancel
- Offer data export before account deletion
- Honor deletion requests within 30 days
- Don't use post-cancel data for marketing without consent
### General Best Practices
- Always show a clear path to complete cancellation
The playbook says data may be deleted after prolonged non-payment but does not consistently require an explicit, prominent warning before that destructive outcome occurs. In a churn-prevention and dunning context, this omission can lead teams to implement pause/cancellation flows that surprise users with irreversible data loss, increasing legal, trust, and customer-harm risk.