Security audit
Security checks for vulnerabilities and agentic risk
This is a plain guidance skill for popup conversion optimization, with no code execution, installation steps, hidden network behavior, or agent persistence.
Safe to install as a marketing guidance skill. When using its personalization and targeting suggestions, make sure implementations respect privacy law, consent requirements, sensitive-data limits, and clear user dismissal preferences.
The manifest description says to use the skill for 'any overlay or interrupt-style conversion element' and includes generic terms like 'overlay' and 'banner'. In a markdown skill description, this is broad enough to overlap with common UX discussions that may not specifically require popup CRO, increasing the chance of unintended invocation.
The skill recommends personalizing popups based on visitor data and pages visited without pairing that guidance with explicit privacy, consent, and lawful-basis constraints in the same section. In practice, this can lead downstream agents or users to implement tracking- and profiling-based targeting that violates privacy expectations or regulatory requirements, especially in jurisdictions with GDPR/ePrivacy-style rules.
The evaluation explicitly rewards the skill for triggering on casual phrasing like 'our popups are annoying everyone,' which is broad enough to overlap with normal discussion about user complaints rather than a clear request for popup-design help. This can cause over-triggering of the skill in unrelated or only tangentially related contexts, leading to poor routing, inappropriate advice, and reduced trust in the agent’s behavior.
No suspicious patterns detected.
