Security audit
Security checks for vulnerabilities and agentic risk
The skill performs limited local document work, but its advertised sample-size calculator is incomplete and needs independent checking.
Use this as a planning aid and calculate sample sizes independently before committing advertising spend. Check rate units and the mismatched baseline field. The output overwrites calculation.md in the selected folder. Treat the optional Windows app as a separate software decision; the benign verdict does not validate that executable.
The code is related to A/B testing, but its implemented behavior is materially narrower than the declared purpose: it produces a static report rather than a calculated test plan. In particular, the sample-size formula is only printed, never executed. The local input reading and report writing are ordinary supporting operations; no unrelated access or hidden external activity is evident.
Without declared permissions the skill's intent is opaque and cannot be validated.
The script promises a sample-size calculation but only writes the supplied inputs and a formula to calculation.md, without calculating or reporting the required sample size. This is an output-integrity flaw rather than a code-execution vulnerability: an agent or user could mistake successful report generation for a completed calculation and proceed with an underpowered test. The skill's advertising and conversion-testing context makes this consequential because invalid test plans can lead to wasted spending and unsupported business decisions.
No suspicious patterns detected.
