Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward automation-planning guide with some privacy cautions users should apply when connecting business tools.
Before installing, treat this as a workflow-design guide rather than a security checklist. When using its examples, connect only necessary accounts, share the minimum fields needed, avoid sending sensitive customer or financial details into chat notifications unless required, and review any workflow that posts publicly, sends campaigns, or changes accounting/CRM records before turning it on.
The trigger phrases are very broad, including common terms like "automate," "automation," and "save time," which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance the agent applies this skill in the wrong context, leading to irrelevant guidance or unintended workflow recommendations.
The skill recommends workflows that transfer customer and business data among third-party services like CRMs, email tools, Slack, accounting platforms, and spreadsheets without warning about privacy, consent, retention, or data minimization. This can normalize moving sensitive data into multiple systems, increasing exposure, compliance risk, and accidental disclosure if users implement the examples without safeguards.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
### Invoice and payment tracking
No suspicious patterns detected.