Security audit
Security checks for vulnerabilities and agentic risk
This is a non-executable founder advice skill with no hidden code or data access; its main issues are broad activation wording and missing privacy caveats in some marketing advice.
Reasonable to install as a founder consulting reference. Treat marketing-tool recommendations as prompts to evaluate privacy, consent, retention, opt-out, and platform-policy requirements before deploying them, and be aware the activation description may make the skill appear in broad business-advice conversations.
The skill's activation description is extremely broad, triggering on many common startup and business terms as well as generic requests for business advice or market analysis. This can cause the skill to be invoked when the user did not intend to use it, leading to over-scoped behavior, response steering, and interference with more appropriate domain skills or the base assistant.
The metadata says the skill should be used whenever broad topic matching occurs, while the body says 'When the user invokes /founder', creating conflicting activation semantics. This inconsistency increases the chance of unintended invocation or unreliable routing, which can let the skill override normal assistant behavior in ambiguous conversations about business topics.
The guidance explicitly recommends capturing user emails and later lists tools for engagement and attribution, but it omits any mention of consent, lawful basis, privacy notices, retention, or unsubscribe requirements. In a founder-oriented skill, this can normalize collecting personal data and running marketing workflows without compliance safeguards, increasing risk of privacy violations and regulatory exposure.
The document recommends push notifications, behavior-based messaging, and attribution tooling without warning that these features often rely on tracking, device identifiers, and consent-sensitive processing. In a startup advisory context, this omission is more dangerous because readers may operationalize the advice directly, leading to undisclosed tracking or messaging practices that violate privacy expectations and applicable law.
The document recommends session recording and heatmap tools like Hotjar, Microsoft Clarity, and Smartlook without any warning about user consent, lawful basis, data minimization, or masking of sensitive fields. In a founder/startup advisory skill, this omission can lead users to deploy invasive analytics by default, increasing the risk of privacy violations, regulatory noncompliance, and accidental capture of sensitive user data.
The guide presents a country-specific investor list under a generic 'Fundraising Guide for Founders' title, which can create a locale mismatch for users expecting globally applicable guidance. Because the Brazil focus is only introduced mid-document rather than clearly scoped up front, this may violate language/locale expectations for a broadly named skill reference.
Telling founders to alert their network to upvote in the first two hours can encourage coordinated engagement manipulation without warning about platform rules or fairness concerns. While not a severe security flaw, it can lead users to violate Product Hunt terms, trigger moderation penalties, or adopt deceptive growth tactics.
