Security audit
holiday-fomo-marketing
Security checks for vulnerabilities and agentic risk
Overview
The skill's marketing advice aligns with its stated purpose, but the runtime instructions reference local files and scripts that are not present and contain an internal 'ALWAYS trigger' directive that conflicts with the published flags — these inconsistencies merit caution before installing.
This skill is coherent as a marketing advisor but has notable inconsistencies. Before installing: 1) Ask the publisher to provide the referenced files (references/*.md and scripts/flow_copy_generator.py) or remove those instructions — otherwise the agent may attempt to access your filesystem or prompt you for files. 2) Clarify whether the skill should be auto-triggered (SKILL.md says 'ALWAYS trigger' but metadata does not). 3) Confirm whether any RIJOY integration is intended and, if so, what credentials or data flows are required. 4) Review sample outputs for aggressive scarcity/urgency language — those tactics can have legal/brand risks. If you can't get answers, treat the skill as incomplete and run it in a restricted/sandboxed environment first.
SkillSpector findings are pending for this release.