Security audit
Security checks for vulnerabilities and agentic risk
This is a plain-language workflow automation guide with sensitive business-app examples, but no hidden code, install actions, or unauthorized persistence.
Install only if you want guidance for building business automations. When connecting real apps, grant the minimum needed permissions, test with non-production or limited data first, review customer/payment data handling, and make sure any live automations can be monitored, paused, and rolled back.
The trigger phrases include very broad terms like 'automate', 'automation', and 'save time', which can match many ordinary requests outside the intended scope. This can cause the skill to activate inappropriately and steer users into connecting tools or automating processes without sufficient relevance or safety review.
The skill encourages connecting business apps, CRMs, forms, payment systems, and customer data flows but does not warn about privacy, consent, data minimization, or corruption risks. In this context, users may automate sensitive personal or financial data handling without safeguards, leading to exposure, misrouting, duplication, or compliance issues.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
### Invoice and payment tracking
No suspicious patterns detected.