Skip to content
Report library
Purpose / Other

Ab Testing Skill Security Audit

What the author says it does (original text)

When the user wants to plan, design, or implement an A/B test or experiment, or build a growth experimentation program. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," "hypothesis," "should I test this," "which version is better," "test two versions," "statistical significance," "how long should I run this test," "gro

Independent security check

Security risks found

Files checked
4
Risks found
2
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 2
Medium risk

Conflicting sample-size and duration guidance can cause tests to end too early

Source references: 6
What we found

The main document and detailed reference give materially different per-variant samples for the same baseline and lift—for example, 150,000 versus 380,000 for a 1% baseline and 10% lift. The reference then gives a duration formula that includes the number of variants, while its quick framework divides a per-variant sample directly by total page traffic, commonly omitting the two-way traffic split.

Why this matters

Using the smaller figures or simplified duration calculation can leave a test seriously underpowered or end it prematurely. Random variation may then be treated as a winner and drive rollout decisions affecting conversion or revenue.

The source supports this risk. For a 1% baseline and 10% relative lift, the main file says 150,000 observations per variant while the detailed guide says 380,000, which could lead users to decide from an underpowered test. The guide’s full duration formula multiplies by the number of variants, but its quick framework divides per-variant sample by page traffic directly. If that traffic is the total split among variants, a standard two-variant test would be estimated at roughly half the needed duration. Users should ask the author to reconcile assumptions, methods, and units, and verify calculations independently.

SKILL.md:83In the instructionsOpen original file
| Baseline | 10% Lift | 20% Lift | 50% Lift ||----------|----------|----------|----------|| 1% | 150k/variant | 39k/variant | 6k/variant || 3% | 47k/variant | 12k/variant | 2k/variant || 5% | 27k/variant | 7k/variant | 1.2k/variant || 10% | 12k/variant | 3k/variant | 550/variant |
Show 5 other places
references/sample-size-guide.md:44In the instructionsOpen original file
| Lift to Detect | Sample per Variant | Total Sample ||----------------|-------------------|--------------|| 5% (1% → 1.05%) | 1,500,000 | 3,000,000 || 10% (1% → 1.1%) | 380,000 | 760,000 || 20% (1% → 1.2%) | 97,000 | 194,000 || 50% (1% → 1.5%) | 16,000 | 32,000 || 100% (1% → 2%) | 4,200 | 8,400 |
references/sample-size-guide.md:98In the instructionsOpen original file
```Duration (days) = (Sample per variant × Number of variants) / (Daily traffic × % exposed)```
references/sample-size-guide.md:252In the instructionsOpen original file
```Daily traffic to page: _____Baseline conversion rate: _____MDE I care about: _____Sample needed per variant: _____ (from tables above)Days to run: Sample / Daily traffic = _____If days > 60: Consider alternativesIf days > 30: Acceptable for high-impact testsIf days < 14: Likely feasible
references/sample-size-guide.md:99In the instructionsOpen original file
```Duration (days) = (Sample per variant × Number of variants) / (Daily traffic × % exposed)```
references/sample-size-guide.md:256In the instructionsOpen original file
Sample needed per variant: _____ (from tables above)Days to run: Sample / Daily traffic = _____
Medium risk

Incorrect p-value interpretation can overstate certainty in experiment decisions

Source references: 2
What we found

The Skill explains p<0.05 as meaning there is less than a 5% chance the result is random. A p-value is instead the probability of observing the current or more extreme data assuming the null hypothesis and model assumptions hold; it is not the probability that the null is true or that the result is random.

Why this matters

A user may treat borderline significance as roughly a 95% probability that the variant wins, overlooking priors, experimental design, repeated testing, and the effect interval. This can create unjustified confidence in commercial rollout or rollback decisions.

The risk is supported, and the same misleading interpretation appears in both the main file and its reference. A p-value is not the probability that the result was caused by randomness or that the conclusion is 95% certain; it is the probability of data this extreme or more extreme assuming the null and model assumptions hold. Using the stated interpretation for a launch decision could overstate the evidence. Users can ask the author to use the conditional definition and require effect size, confidence intervals, planned sample size, and test assumptions.

SKILL.md:195In the instructionsOpen original file
### Statistical Significance- 95% confidence = p-value < 0.05- Means <5% chance result is random- Not a guarantee—just a threshold
Show 1 other places
references/sample-size-guide.md:34In the instructionsOpen original file
**Statistical significance (95%)**: Means there's less than 5% chance the observed difference is due to random chance.**Statistical power (80%)**: Means if there's a real effect of size MDE, you have 80% chance of detecting it.

Inside this skill

8 instruction sections

This Skill is a documentation-only guide for designing statistically valid, actionable A/B tests. The supplied materials contain no scripts, installation commands, or instructions to transmit data.

View source
SKILL.md:8In the instructionsOpen original file
# A/B Test SetupYou are an expert in experimentation and A/B testing. Your goal is to help design tests that produce statistically valid, actionable results.

At runtime, it first reads product-marketing files under several conventional names and uses their contents to reduce follow-up questions. This may expose the Skill to internal conversion and business context, but the visible instructions do not direct external disclosure.

View source
SKILL.md:14In the instructionsOpen original file
**Check for product marketing context first:**If `.agents/product-marketing.md` exists (or `.claude/product-marketing.md`, or the legacy `product-marketing-context.md` filename, in older setups), read it before asking questions. Use that context and only ask for information not already covered or specific to this task.

The guidance calls for predetermined sample sizes, avoiding early stopping after peeking, and monitoring guardrail metrics; these controls are intended to reduce false decisions and user harm.

View source
SKILL.md:36In the instructionsOpen original file
### 3. Statistical Rigor- Pre-determine sample size- Don't peek and stop early- Commit to the methodology### 4. Measure What Matters- Primary metric tied to business value- Secondary metrics for context- Guardrail metrics to prevent harm
Start here · InstructionsSKILL.md
ab-testing
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 8 more sections are available in the original file.

File reference map

References: 2
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records4 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/sample-size-guide.mdFull text included
  • references/test-templates.mdFull text included
  • evals/evals.jsonFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • evals/evals.jsonSupporting file
  • references/sample-size-guide.mdSupporting file
  • references/test-templates.mdSupporting file

Operations mentioned in code and instructions

Connect to websites
SKILL.md:91In the instructionsOpen original file
**Calculators:**- [Evan Miller's](https://www.evanmiller.org/ab-testing/sample-size.html)- [Optimizely's](https://www.optimizely.com/sample-size-calculator/)
SKILL.md:92In the instructionsOpen original file
- [Evan Miller's](https://www.evanmiller.org/ab-testing/sample-size.html)- [Optimizely's](https://www.optimizely.com/sample-size-calculator/)
references/sample-size-guide.md:144In the instructionsOpen original file
**Evan Miller's Calculator**https://www.evanmiller.org/ab-testing/sample-size.html- Simple interface
Lines read
1,002
File checksum (to compare versions)
b49103561db657b6ef2fa393a563506ff99670c92e1863e87e430352e83359c9