Security audit
Security checks for vulnerabilities and agentic risk
This skill is a plain-language SaaS churn and payment-recovery guide with no executable code or hidden system access.
Installers should treat this as business and product guidance, and should still review any billing-provider or cancellation-flow changes before applying them in production, especially where cancellation and data-retention laws apply.
The skill description is unusually broad and includes many generic churn/retention phrases, which can cause the agent to invoke this skill in loosely related conversations. Over-broad routing is a real security and safety issue because it increases the chance of unintended file reads, tool suggestions, or persuasive business guidance being applied outside the user's actual intent.
This JSON eval file is a manifest-type file, so vague-trigger checks apply. The expected output and assertion explicitly require the skill to 'trigger on casual phrasing,' but they do not define boundaries, specific allowed phrases, or negative examples, creating a risk of unintended invocation from everyday language.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Inform users about data retention period post-cancel
- Offer data export before account deletion
- Honor deletion requests within 30 days
- Don't use post-cancel data for marketing without consent
### General Best Practices
- Always show a clear path to complete cancellation