Security audit
Security checks for vulnerabilities and agentic risk
This markdown-only skill provides AP payment decision support, but users should treat its vendor outreach and payment-extension examples as human-reviewed advice only.
Install only if you want finance decision-support for AP timing. Keep vendor invoices and pricing private, do not allow the skill to send vendor communications or payments directly, and have a finance owner review any payment-extension or discount-negotiation language before use.
The skill explicitly says it is not for vendor contract negotiation, but later includes a dynamic discount negotiation proposal and a ready-made script to request new terms. This internal contradiction weakens operator trust boundaries and can mislead an agent or user into using the skill for unauthorized negotiation activities, creating compliance, contractual, and financial risk.
The documentation broadens the skill from payment timing optimization into advising on stretching payments and contacting vendors about delayed payment. This scope drift can cause the agent to generate guidance that affects vendor relationships and legal/payment commitments, despite the skill being presented as an analytics tool rather than a communications or negotiation agent.
The skill goes beyond decision-support analytics and provides vendor discount negotiation and payment-extension scripting. That expands the agent from passive analysis into operational guidance that can influence external counterparties, increasing the chance of unauthorized negotiation, policy bypass, or financially harmful recommendations outside the declared scope.
No suspicious patterns detected.
