Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent A/B testing workflow skill with disclosed local experiment archiving, but users should be aware it can persist experiment details in memory files.
Install only if you want a structured A/B testing workflow that may save experiment summaries and findings under memory/experiments. Avoid using sensitive, confidential, or proprietary prompts and outputs unless you are comfortable with those details being retained, and ask the agent not to archive or to redact details when needed.
The manifest says to activate when the user says phrases like "design an experiment" or "compare X vs Y," and also when the user merely "wants to validate a hypothesis via controlled comparison." These conditions are broad, overlap with ordinary analytical requests, and do not provide exclusion criteria or negative examples, which could cause unintended invocation.
The skill directs the agent to persist experiment outputs and summaries to memory files without requiring user consent, disclosure, or data minimization. If prompts, outputs, or task samples contain sensitive user data, this can create unintended long-term retention and secondary exposure through later reads or reuse.
Archiving hypotheses, detailed analyses, and template updates to persistent files compounds privacy risk because it stores richer derived artifacts that may include user intent, proprietary prompts, evaluation data, and conclusions. The absence of retention boundaries or disclosure makes accidental leakage, overcollection, and inappropriate cross-session reuse more likely.
Large portions of the workflow, prompts, examples, and reporting format are written in Chinese, but the skill does not state that it is Chinese-only or allow the user to choose their preferred language. This can amount to an implicit language policy constraint without opt-in.
No suspicious patterns detected.
