Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only email marketing guidance skill with some privacy-compliance caveats, but no hidden execution, persistence, or destructive behavior.
Before using this skill for real campaigns, make sure any personalization or behavior-based triggers rely on data you are allowed to use, avoid sensitive attributes, and comply with consent, unsubscribe, and regional privacy rules. The skill is suitable as strategic writing guidance; treat implementation through email platforms as a separate step requiring normal review and approvals.
The manifest description says to use the skill when the user wants to create or optimize an email sequence, and also includes broad phrases like "what emails should I send" and "Use this for any multi-email automated flow." Those phrases are expansive enough to overlap with many general marketing requests, without clear boundaries or negative examples beyond two adjacent skills.
The skill guides the agent to reason about audience context, triggers, beliefs, and relationship state without any privacy guardrails around use of customer or behavioral data. In practice, this can normalize collecting or processing sensitive segmentation attributes without user warnings, minimization, or consent checks, increasing the risk of privacy violations or inappropriate profiling.
This JSON manifest/evals file includes expectations that the skill 'Should trigger on casual phrasing' and asserts 'Triggers on casual phrasing.' That activation guidance is ambiguous and broad enough to overlap with everyday speech, increasing the risk of unintended invocation.
This guidance encourages behavior-based and personalized outreach using product-usage signals (for example, referencing what a user did or did not do) without any caution about consent, transparency, data minimization, or jurisdiction-specific privacy requirements. In a marketing automation skill, that omission can lead implementers to deploy intrusive or non-compliant messaging that exposes sensitive behavioral data, increases regulatory risk, and erodes user trust.
This markdown file gives operational guidance for using merge fields, dynamic content, triggered emails, and segmentation by behavior/profile, which can affect user privacy and data handling. Under SQP-2 for markdown files, the description should warn that these practices rely on user data and should be used transparently and in compliance with consent/privacy requirements.
No suspicious patterns detected.
