Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only UX research template skill with no hidden execution, but users should handle participant data and recordings with normal privacy controls.
Safe to install for UX research templates. Before using it with real participants, make sure recruiting uses consented or otherwise approved contact lists, recording consent is explicit, personal data is minimized, and notes or recordings are stored with retention limits and restricted access.
Recommending recruitment from an existing user database without any notice about lawful basis, consent, purpose limitation, or outreach disclosure can encourage misuse of customer data for research recruitment. Because this is presented as a best-quality channel, operators may follow it by default and contact users in ways that violate privacy expectations or internal policy.
The skill instructs users to record sessions and store participant notes, demographics, quotes, and recordings in a repository, but it does not warn about consent, retention limits, access controls, de-identification, or applicable privacy laws. In a UX research context this is actionable operational guidance, so omission can directly lead to over-collection or insecure storage of sensitive participant data.
The example screener includes "language: [e.g., English-fluent]", which can normalize a default language constraint without explaining when such a restriction is justified. Under the policy, forcing a specific language without user choice or clear locale-specific rationale can be a natural-language policy violation.
No suspicious patterns detected.
