Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only wholesale pricing guidance skill with coherent business templates, but users should review buyer-facing documents for internal notes and payment details before sharing.
Before installing or using this skill, treat its templates as drafting aids. Remove the internal-notes sections before sending buyer-facing PDFs, and only include real bank/routing information if your finance process approves sharing those details through that document.
The template contains an 'Internal notes' section with floor price, MDF budget, commissions, and exception approvals inside the same document intended for wholesale buyers. This creates a clear risk of accidental disclosure of highly sensitive commercial terms that could weaken negotiation position, reveal internal incentives, and expose confidential pricing controls.
Including bank/routing details in a buyer-facing wholesale price sheet unnecessarily exposes sensitive financial information outside the template’s core purpose. If the wrong version is shared, recipients gain data that can enable payment fraud, social engineering, or misuse of internal finance processes.
This markdown file is a customer-facing output template, but it contains an internal-only section with floor pricing, MDF budget, commissions, and approver details. Although it says 'strip before sending,' the template lacks a stronger user-facing warning earlier in the document that sharing these notes would expose sensitive business information.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
### What this policy is
MAP is the minimum price at which [Brand Name] products may be **advertised or displayed publicly** — including but not limited to:
- Retailer websites.
- Online marketplaces (Amazon, eBay, Walmart.com, etc.).