Security audit
Security checks for vulnerabilities and agentic risk
This skill is openly built for invoice tracking, but it can automatically contact clients about payments without enough confirmation and control safeguards.
Review this carefully before installing. Use least-privilege Google credentials, verify all client contact fields, keep reminder sending in preview/approval mode if possible, and avoid unattended cron sending until you have clear limits, logs, and a way to pause all outbound reminders.
The skill explicitly promises autonomous email and WhatsApp payment follow-ups, which can cause the agent to contact third parties without a just-in-time confirmation or a prominent user warning. In a billing context, mistaken reminders, misdirected messages, or overly aggressive cadence can harm client relationships and disclose invoice status or payment pressure to unintended recipients.
The skill processes sensitive personal and financial data including client names, emails, WhatsApp numbers, invoice amounts, GSTIN, bank account numbers, and UPI IDs, yet it provides no explicit privacy, retention, or data-handling warning. In this context, the combination of payment data and contact automation increases the risk of unauthorized disclosure, misuse of financial details, and privacy violations if the sheet, logs, or outbound messages are mishandled.
The description frames the skill specifically for 'Indian freelancers' and embeds India-specific assumptions such as GST, INR, WhatsApp usage, and IST. Under the language/locale policy, locale-specific targeting should be clearly justified or presented as an explicit regional specialization rather than an implied default for all users.
No suspicious patterns detected.
