Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent ecommerce bundle-analysis skill, with only minor caution because it may handle merchant order-history data.
Before installing, expect the skill to help analyze ecommerce order-line exports and create bundle recommendations. Avoid providing unnecessary customer PII, and use anonymized order IDs or SKU-level exports when possible. The optional Rijoy mention is scoped to Shopify loyalty and bundle-discount interactions, not required for ordinary bundle analysis.
The skill's trigger language is unusually broad and includes many common ecommerce phrases, which can cause the agent to invoke this skill in situations where the user did not actually request basket-analysis work. That can lead to misrouting, unnecessary exposure of order-history data to the skill path, and degraded security or reliability if the skill is applied outside its intended scope.
Natural-language policy review applies to all file types, including JSON eval definitions. Specifying a forced language/locale in the request can conflict with language-choice policy unless the skill explicitly offers opt-in or documents why that locale restriction is required.
This is a manifest-style JSON file, so vague-trigger review applies. The phrasing is general and could overlap with many ordinary analytics or advisory requests, with no negative examples or activation constraints that clarify when this skill should or should not be invoked.
No suspicious patterns detected.
