Security audit
Security checks for vulnerabilities and agentic risk
This is a Spanish content-strategy workflow skill that uses disclosed web research tools and writes a generated strategy file, with no evidence of hidden execution, persistence, destructive behavior, or credential theft.
Before installing, be comfortable with a Spanish, FÓRMULA 100K-specific workflow that may use connected research services and save/send a generated strategy document. Avoid providing private client data or sensitive business details unless you are comfortable sharing the relevant search terms, avatar summary, links, and public account handles with the configured providers.
The instruction to activate 'SIEMPRE' for a wide set of phrases removes normal scope checks and encourages unconditional takeover of many common content-related requests. This is dangerous because it can force the agent into a long workflow, trigger research/tooling paths, and override user expectations even when the request is only loosely related.
The trigger list is broad and overlaps with ordinary user requests such as asking what to post this week, which can cause the skill to activate outside a clearly bounded context. In a multi-skill agent, this increases the chance of inappropriate routing, unnecessary data collection prompts, or unexpected tool use when the user only wanted lightweight advice.
The instructions require "Audiencia hispana, español neutro obligatorio (NO voseo)", which imposes a locale/language variant policy on all interactions. There is no indication that the user can choose another Spanish variant or opt into voseo if preferred.
The anti-error rule says "NUNCA uses voseo argentino" and mandates specific second-person forms, enforcing one regional language style. This is a natural-language policy concern because it removes user choice over dialect and locale without opt-in.
La línea L122 ordena 'NO uses voseo argentino' y fuerza el uso de 'tú' de forma absoluta. Esto constituye una restricción de lenguaje/locale en lenguaje natural sin opt-in del usuario ni justificación regional documentada.
This markdown file contains user-facing instructional content entirely in Spanish, but it does not indicate that the language is optional, user-selected, or required for a specific regional purpose. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
This markdown file contains user-facing instructions exclusively in Spanish, including headings, rules, and operational guidance. Under the language/locale policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the restriction is explicitly justified, which is not present here.
The skill directs the agent to send user-derived data such as niche, avatar description, keywords, links, and account references to multiple third-party services (Apify, Tavily, vidIQ, Supadata) without an explicit notice or consent step. This creates a real privacy and data-governance risk because potentially sensitive business context or personal profile information may be transmitted externally even when the user may not expect that disclosure.
No suspicious patterns detected.
