Security audit

Page Cro

Security checks for vulnerabilities and agentic risk

Overview

This is a marketing-page conversion advice skill with no executable code, but users should apply its tracking and personalization suggestions with normal privacy review.

Installers should understand that this skill provides CRO recommendations only. Before implementing suggestions involving hidden fields, enrichment, tracking, gated downloads, or personalization, review consent, privacy notices, data minimization, opt-out handling, and legal requirements for the target audience.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation text is unusually broad and explicitly says to use the skill even when a user only shares a URL and asks for feedback, which can cause the router to invoke this skill for many generic page-review requests. That creates scope hijacking risk: the assistant may steer broad UX/content/debugging requests into CRO-specific advice, reducing precision and potentially suppressing better-matched skills.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: This manifest-style JSON file explicitly treats the casual phrase "this page isn't converting" as a valid trigger. That phrase is broad, overlaps with ordinary speech, and the file does not provide clear scope boundaries or exclusion conditions, increasing the risk of unintended invocation.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Suggesting hidden auto-filled form field enrichment without transparency can lead to covert collection or inference of user attributes beyond what the form visibly requests. On a demo request page, this increases the chance of deceptive data collection practices and noncompliant enrichment from third-party sources.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The experiment proposes personalized messaging based on visitor data/source without any guardrails around consent, transparency, or limiting use of personal data. In a marketing optimization context, this can encourage profiling or use of referral/behavioral data in ways that users do not expect, creating privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The markdown proposes 'Download tracking' with gating and engagement tracking, which could affect user privacy and data collection practices. The document provides no warning or disclosure that these experiments involve tracking user behavior or collecting additional user data.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: Site-wide dynamic personalization by segment implies broad behavioral or attribute-based content targeting, yet the document provides no privacy limitations or consent expectations. Because it is site-wide, misuse can scale across many pages and normalize opaque tracking-based experiences.

Static analysis

No suspicious patterns detected.