Security audit
Security checks for vulnerabilities and agentic risk
This is a signup-flow optimization guidance skill with no code execution, persistence, or hidden data access.
Installers should understand that this skill may be selected for loosely phrased signup-conversion questions and may read a local product-marketing context file if one exists, but the inspected artifact is advisory and does not execute code or make changes.
The description says to use the skill whenever a user has a signup or registration flow that 'isn't performing,' alongside broad phrases like 'people aren't signing up' and 'simplify our signup.' This creates an ambiguous trigger boundary because many general product, growth, or UX discussions could match without clearly indicating this specific skill should activate instead of related skills.
The eval explicitly rewards triggering on 'casual phrasing,' which broadens routing criteria and can cause the signup skill to activate on vague requests that may belong to other skills. In this context, over-broad dispatch can produce incorrect guidance, suppress more appropriate skills such as CRO or onboarding, and increase the chance of unintended behavior from loosely matched prompts.
