Security audit
Security checks for vulnerabilities and agentic risk
This is a marketing-prompt kit with no executable behavior, but some review-request templates contradict its own compliance claims and should be edited before use.
Installers should treat this as a prompt/template library, not legal advice. Before using outputs publicly, remove satisfaction-gated review wording, adapt Clark County/Nevada references to the correct jurisdiction, verify all license/permit/credential claims, and avoid unnecessary customer personal details.
The skill states that review requests must be unconditional, but the templates use satisfaction-conditioned language such as asking for a review only if the customer is happy or if the business earned it. That creates review gating risk and can lead users to generate FTC-noncompliant outreach despite the prompt's stated compliance posture, which makes the contradiction especially dangerous.
The card template explicitly asks for a review only 'if you're happy,' which contradicts the earlier FTC-ground-rule language prohibiting positive-sentiment gating. Because this skill is marketed as compliant, users may rely on it without spotting the inconsistency and deploy legally risky review solicitation language.
The verbal walkthrough script conditions the review request on the client being happy, which is inconsistent with the prompt's own rule that requests must be unconditional. In a script intended for frontline staff, this increases the chance that noncompliant language is used in real customer interactions at scale.
This aging-in-place verbal script also ties the review ask to customer satisfaction, directly undermining the no-gating rule stated elsewhere in the skill. Since the skill frames itself as compliance-aware, the mismatch may create misplaced trust and downstream regulatory exposure.
The commercial verbal script asks for a review only if the client is satisfied, again conflicting with the stated compliance requirement against positive-sentiment gating. This is a real compliance flaw because the skill operationalizes noncompliant wording in a reusable script.
The response templates state that permits are handled through Clark County, which imposes a specific local jurisdiction in natural-language content. The file does not clearly frame this as a locale-specific skill or provide user choice, so users outside that region could be forced into inaccurate localized output.
As a markdown file, this content falls under the vague-trigger review scope. The 'How to Use' section tells the user to fill in fields and run the prompt, but it does not define when this skill should or should not be used, nor does it provide negative examples or a narrow invocation context, which can lead to unintended use in adjacent marketing scenarios.
The prompt's compliance gates prohibit unsupported warranty-style claims such as "lifetime guarantee" (L022, L414), but the description at L110 says the waterproofing system is "built to last." That wording materially undercuts the stated compliance intent by implying an unbounded durability claim while the surrounding guidance says such claims must be tightly qualified.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
## The Problem with Generic AI for Bathroom Remodeling
Every AI tool and copywriter produces bathroom remodeling copy that contains multiple federal and state violations:
- "ADA compliant bathroom renovation" — ADA Title III applies to commercial facilities only; residential is voluntary Fair Housing Act
- "We handle everything in-house — plumbing, electrical, tile, all trades" — NRS 624.730 criminal offense without licensed sub disclosure
- "No permit needed for this update" — Clark County requires permits for all bathroom remodels; no-permit claims stop home sales at closing
- "EPA-certified lead-safe removal included" — EPA RRP Firm Certification + Certified Renovator required for pre-1978 homes; omitting it = $37,500/day penalty
- "We also handle any mold we find" — mold remediation requires IICRC S520 scope separation and separate licensure; scope-creep claim voids insurance
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- "We handle everything in-house — plumbing, electrical, tile, all trades" — NRS 624.730 criminal offense without licensed sub disclosure
- "No permit needed for this update" — Clark County requires permits for all bathroom remodels; no-permit claims stop home sales at closing
- "EPA-certified lead-safe removal included" — EPA RRP Firm Certification + Certified Renovator required for pre-1978 homes; omitting it = $37,500/day penalty
- "We also handle any mold we find" — mold remediation requires IICRC S520 scope separation and separate licensure; scope-creep claim voids insurance
- "Remove any wall to open your bathroom" — load-bearing wall removal requires PE stamp (NRS 625); "any wall" = engineering scope misrepresentation
- "Lifetime waterproofing guarantee" — Magnuson-Moss §104 requires written warranty terms; scope limits; "guarantee" without conditions = FTC unfounded claim
The template explicitly references a client's property sale and property address in outreach content, which can affect user privacy if used carelessly. While the file is compliance-focused, it does not warn users to avoid including sensitive personal details or to verify consent before referencing transaction-specific information in review requests.