Security audit
Security checks for vulnerabilities and agentic risk
This is a marketing guidance skill for community group buying, with no hidden execution or privileged access, though users should apply consent and privacy controls before using its outreach templates.
Before installing or using it, treat this as an advisory marketing playbook. Ensure all group posts, private messages, purchase-history segmentation, coupons, and reactivation campaigns follow applicable privacy laws, platform terms, consent requirements, and opt-out requests. Review the retention calculator labels before relying on its metrics.
The skill prescribes repeated group messaging on a fixed schedule without any guardrails for consent, opt-out, rate limiting, or platform policy compliance. In practice, this can facilitate spammy outreach, increase the risk of user harassment complaints, and push operators to process engagement data without appropriate privacy controls.
The reactivation playbook uses prior purchase behavior and inactivity windows to drive personalized direct messages, but it omits any privacy, consent, or data-governance safeguards. This creates risk of unlawful profiling or intrusive outreach, especially where purchase history is personal data subject to consent, transparency, and retention obligations.
文档在模块边界中明确写明“具体的活动形式设计、优惠券体系、大促策划 → 模块六”，表示本技能应聚焦获客留存而非促销策划细节。但 Tool 2 仍实现了活动成本拆解、ROI判断、CAC计算和执行建议，实质上提供了营销活动评估与预算决策能力，超出了该边界声明。
calculateRetentionMetrics 的注释与返回值声称计算的是“次日/7日/30日留存率”，但入参明确是第1周到第4周的周级用户数，实际计算的是周级留存比率而非“次日留存率”。这会让调用者误以为该工具可用于日留存分析，属于文档对代码行为的主动误导。
No suspicious patterns detected.
