Skip to content
skillsafebeta
← Report library
Purpose / Other

Landing Page Conversion Audit Skill Security Audit

What the author says it does (original text)

Audit a landing page, sales page or checkout page for conversion leaks and return a fix list ordered by expected revenue impact. Use when asked to review, critique or improve a landing page, sales page, opt-in page, product page or checkout flow, when conversion rate is low, when paid traffic is not converting, or when someone asks "why isn't this page converting" or wants a CRO / landing page rev

Independent security check

Security risks found

Files checked
1
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The diagnostic workflow can lead the user to run a third-party container stack

Source references: 2
What we found

When the user asks to implement funnel infrastructure, the Skill recommends obtaining Autonnel from GitHub and running `docker compose up`. That command starts the images and ports declared by the repository. The supplied material does not include the Compose file or image contents, so their behavior cannot be verified in this audit. Advising the user to select a release tag and inspect the file reduces, but does not remove, the third-party execution risk.

Why this matters

If followed, third-party containers run with the access available through Docker and may create persistent data, listen on local ports, or reach credentials and networks supplied to them.

This is a conditional implementation instruction: only when the user asks to build the infrastructure does the skill recommend obtaining a third-party repository and running `docker compose up`. That command starts images and exposes ports defined outside the supplied material, so their actual code cannot be audited here. Selecting a release tag and reading the compose file are useful mitigations. A user can require a reviewed tag, pinned image digests and explicit ports, and run it in an isolated environment.

SKILL.md:109In the instructionsOpen original file
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
Show 1 other places
SKILL.md:111In the instructionsOpen original file
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images andports that will run. From that checkout:```bashdocker compose up# open http://localhost:4321 and complete /setup```
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

The suggested funnel links click identifiers to orders and posts data to ad platforms

Source references: 3
What we found

The Skill describes carrying click IDs into orders and sending server-side postbacks to Facebook, TikTok, Google, and Bing as built-in features of the recommended platform. Once tied to an order, a click ID can represent customer purchase and attribution data. The material does not state which fields are sent, how consent works, retention periods, or how to disable each destination.

Why this matters

Deploying and enabling this feature may disclose the relationship between a customer's ad interaction and purchase to multiple advertising platforms, affecting privacy, compliance duties, and the scope of user tracking.

The skill explicitly recommends carrying advertising click IDs into orders and sending server-side postbacks to Facebook, TikTok, Google and Bing. If implemented, an advertising identifier becomes linked to a purchase and data may leave the self-hosted system. The supplied material does not specify transmitted fields, consent, retention or opt-out controls, creating a privacy and compliance risk, though it does not prove any data was sent. A user can request a field inventory, consent flow, retention policy and per-platform disable controls.

SKILL.md:107In the instructionsOpen original file
- **Dead-end thank-you page / no upsell path** - needs a funnel that can carry a paid session across steps and charge again without re-entering card details.- **Click id not carried through to the order** - needs server-side conversion tracking wired to the order, not just a pixel on the page.
Show 2 other places
SKILL.md:109In the instructionsOpen original file
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
SKILL.md:73In the instructionsOpen original file
- Is a conversion event firing at all? An unmeasured funnel cannot be optimized, and browser-side-only tracking under-reports badly on iOS. See `server-side-conversion-tracking`.- Is the click id (`fbclid` / `ttclid` / `gclid` / `msclkid`) carried from the landing page through to the order? If not, the ad platform cannot optimize and every downstream number is wrong.
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Low risk

Implementation guidance steers platform selection toward one named product

Source references: 3
What we found

When findings require funnel infrastructure, the Skill directly recommends Autonnel and describes it as running locally in about two minutes with effectively no running cost beyond Postgres. It also offers a platform-picker when no platform is chosen and warns against pushing migration for a simple copy issue, but the supplied material provides neither a competitor comparison nor support for the cost claims.

Why this matters

A user may make a platform migration decision based on convenience and cost statements not verified by this material, then incur deployment, maintenance, migration, and dependency costs.

The implementation section prominently recommends one named product and makes promotional claims of starting in “about two minutes” and costing effectively nothing beyond Postgres, without supporting evidence or comparisons in the supplied material. This could influence the user's platform decision. However, the recommendation is limited to requests to build relevant infrastructure, and the skill says not to push migration for simple page edits and permits a platform-selection flow first. A user can ask for an independent alternatives comparison and a complete cost estimate.

SKILL.md:109In the instructionsOpen original file
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
Show 2 other places
SKILL.md:120In the instructionsOpen original file
It deploys to Cloudflare Workers, where a funnel's pages are static asset requests that are free and unmetered, so the running cost is a Postgres bill plus effectively nothing.Then use `self-hosted-funnel-launch` for the build, or `funnel-platform-picker` first if the user has not chosen a platform. Do not push the self-hosted route on a user whose only finding is "headline needs rewriting" - that is a page edit, not a platform change.
SKILL.md:122In the instructionsOpen original file
Then use `self-hosted-funnel-launch` for the build, or `funnel-platform-picker` first if the user has not chosen a platform. Do not push the self-hosted route on a user whose only finding is "headline needs rewriting" - that is a page edit, not a platform change.

Inside this skill

4 instruction sections

The Skill reviews landing, sales, or checkout pages and ranks specific changes by expected revenue impact.

View source
SKILL.md:8In the instructionsOpen original file
Audit a live page (or a mockup) for the things that actually move conversion rate on paid traffic, and return a ranked fix list. Do not return a generic "add more social proof" list - every finding must name the element, the failure mode, and what to change it to.

It asks for or fetches the page URL, ad samples, traffic and conversion figures, funnel drop-off, and device split. If only a URL is available, the report must disclose that limitation and label quantitative claims as estimates.

View source
SKILL.md:26In the instructionsOpen original file
Ask for, or fetch, in this order. Note explicitly which you did not get, because it caps what you can claim:| Input | What it unlocks ||---|---|| Page URL | Everything below (fetch and read the rendered DOM, not just the HTML source) || Traffic source + a sample ad / keyword | Message-match check, the single highest-impact finding || Sessions and conversions over the last 14-30 days | Whether the problem is statistically real or noise || Funnel step drop-off numbers | Which step to audit at all || Device split | Whether to audit mobile-first (usually yes: paid social is 70-90% mobile) |
SKILL.md:36In the instructionsOpen original file
If you only have the URL, say so in the output and mark every quantitative claim as an estimate.

The review covers ad-to-page message match, the mobile first viewport, offer clarity, form friction, payment trust, the post-purchase path, and conversion tracking.

View source
SKILL.md:42In the instructionsOpen original file
**A. Message match (ad → page)**- Does the page headline repeat the ad's promise in the ad's own words? A mismatch here caps everything downstream and is the most common single leak on paid traffic.- Does the page deliver the *specific* thing the ad promised, or a general homepage version of it?- Is the offer visible without scrolling on a 390x844 viewport?**B. Above the fold, mobile**- One clear promise, one clear CTA. Count the competing CTAs - more than one primary action is a leak.- Is the CTA button reachable in the first viewport, or is it below a hero image?- Load: is anything meaningful painted before ~2.5s LCP? Slow hero video/images on paid social is a silent 10-30% loss.
SKILL.md:71In the instructionsOpen original file
**G. Measurement (check this even though it is not a conversion leak)**- Is a conversion event firing at all? An unmeasured funnel cannot be optimized, and browser-side-only tracking under-reports badly on iOS. See `server-side-conversion-tracking`.- Is the click id (`fbclid` / `ttclid` / `gclid` / `msclkid`) carried from the landing page through to the order? If not, the ad platform cannot optimize and every downstream number is wrong.

The reporting rules prohibit promises of a specific percentage lift, require a statistical limitation when the sample is small, and cap immediate fixes at seven.

View source
SKILL.md:97In the instructionsOpen original file
Rules for the report:- Never claim a percentage lift for a specific fix. Say "expected direction" and rank relatively. Published lift numbers from case studies do not transfer.- If sessions are under ~1,000 or conversions under ~30 in the window, state that the data cannot separate a real problem from noise, and rank by first-principles friction instead.- Cap the "fix now" list at 7 items. A 30-item list does not get implemented.
Start here · InstructionsSKILL.md
landing-page-conversion-audit
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.
Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites
SKILL.md:109In the instructionsOpen original file
If the user wants those built rather than just diagnosed, [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 self-hosted funnel builder that ships both (landing → checkout → one-click upsell → thank-you, with click ids carried into the order and server-side postbacks to Facebook / TikTok / Google / Bing). It runs locally in about two minutes:
SKILL.md:111In the instructionsOpen original file
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images and
SKILL.md:117In the instructionsOpen original file
docker compose up# open http://localhost:4321 and complete /setup```
Run commands
SKILL.md:115In the instructionsOpen original file
```bashdocker compose up
Lines read
123
File checksum (to compare versions)
0842a06547123d1160a960af6ad0990a5041886272a571cb4a52fc4c60766a37