Security audit
Security checks for vulnerabilities and agentic risk
This skill provides popup conversion advice and does not contain executable code, hidden persistence, or unrelated data-handling behavior.
Before installing, be aware that the skill may be invoked for a wide range of popup, modal, banner, or overlay conversion requests and may read local product-marketing context files if they exist. That behavior is disclosed and aligned with its purpose; keep confidential marketing context out of those files if you do not want it used in recommendations.
The manifest description says to use the skill for popups, modals, overlays, slide-ins, banners, and then broadens further with 'Use this for any overlay or interrupt-style conversion element.' This activation scope is expansive and lacks clear exclusions, increasing the chance of unintended invocation for common UI discussions that may not be specifically about popup CRO.
The eval explicitly expects the skill to trigger on casual phrasing like 'our popups are annoying everyone,' which broadens activation beyond clear popup-optimization requests. In an agent routing context, this can cause unintended invocation of the popup-cro skill on ambiguous complaints or adjacent UX discussions, leading to misrouting, irrelevant guidance, or bypass of a more appropriate specialized skill.
No suspicious patterns detected.
