Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent fundraising helper, but it can drive investor outreach and deck sharing without clear approval, privacy, or confidentiality safeguards.
Review this skill carefully before installing. Use it only with explicit human approval for every outreach message, verify recipients from approved and lawful contact sources, and redact confidential metrics, customer data, strategy, and fundraising details before sharing any deck or email externally.
The skill embeds a specific third-party investor's personal contact information in generic documentation, which creates an unnecessary privacy and data-handling risk. Publishing or operationalizing direct personal contact details can enable unsolicited outreach, spam, or misuse, especially when the skill encourages agents to act on that information automatically.
The skill instructs the agent to conduct investor outreach and send pitch decks without warning about external disclosure risks, confidentiality, or user approval. This can lead to unauthorized sharing of sensitive startup information, including proprietary strategy, metrics, customer details, or unpublished fundraising plans, with external parties.
This README describes the skill's purpose and features but does not specify how or when the skill should be invoked, nor any boundaries on triggering conditions. For a markdown skill description, the absence of explicit trigger phrases, scope limits, or exclusion examples can lead to ambiguous or overly broad invocation behavior.
Including a specific investor email address without any handling guidance normalizes the use of personal contact data without consent, provenance checks, or privacy safeguards. Even if the address is business-related, embedding it in reusable agent instructions can facilitate inappropriate reuse, scraping, and mass outreach.
No suspicious patterns detected.
