Security audit
Security checks for vulnerabilities and agentic risk
This is a product analytics guidance skill whose tracking examples are expected for its purpose, with privacy considerations users should still review before implementation.
Before installing or using this skill to add tracking, confirm what data will be sent to analytics providers, avoid unnecessary personal data, use pseudonymous identifiers where possible, and make sure consent, privacy notices, and retention rules match your product and jurisdiction.
The invocation description includes broad terms like "measure" and especially "or any task related to measuring product performance and user behavior," which lacks clear scope boundaries. This can cause the skill to activate for many general product or business discussions beyond a narrowly defined analytics request.
The skill provides concrete analytics instrumentation code, including event capture and user identification, without an explicit warning that this may collect and transmit user or behavioral data to a third-party analytics service. In agent contexts, this can normalize adding tracking code without informed consent, data minimization, or jurisdiction-specific compliance checks, increasing privacy and compliance risk.
