跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Sales Funnel Blueprint Skill 安全审计

作者说它能做什么（原文）

Turn an offer into a concrete multi-step sales funnel spec - page-by-page structure, price ladder, copy outline and the metrics each step must hit. Use when asked to build a sales funnel, marketing funnel, landing page flow, lead magnet funnel, webinar funnel, tripwire or VSL funnel, when planning a product launch page flow, or when someone asks "what pages do I need" for selling something online.

第三方安全检查结论

发现安全风险

已检查文件
1
发现的风险
4
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。发现 1 项风险
中风险

运行外部仓库的 Docker Compose 会在本机执行其容器配置

原文依据：1 处
发现了什么

Skill 指示用户从外部 GitHub 仓库取得代码并运行 docker compose up。虽然它建议先阅读 compose 文件和选择发布标签，但提供的证据不包含该仓库、镜像、挂载、入口脚本或固定镜像摘要，因此无法从本次材料验证实际执行内容。

为什么需要注意

Compose 配置可以拉取并执行容器镜像、开放端口以及挂载主机目录。如果外部标签、镜像或配置被篡改，可能影响本机文件、凭据、网络服务或数据库。

这是有条件的本机执行风险：只有用户选择该项目并运行命令时，Docker 才会启动外部仓库声明的镜像和配置。技能建议检出发布标签并先阅读 compose 文件，这降低了风险，但材料未包含 compose 内容、镜像摘要、挂载或入口脚本，无法审计容器将获得的访问权限或实际运行内容。用户可要求固定提交和镜像摘要，并在运行前审查端口、卷、环境变量及特权。

SKILL.md:120来自说明文档打开原文件
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images andports that will run. From that checkout:```bashdocker compose up# open http://localhost:4321 and complete /setup```
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 1 项风险
中风险

广告点击标识会与订单关联，并向广告平台回传购买金额

原文依据：1 处
发现了什么

Skill 要求把 fbclid、ttclid、gclid 或 msclkid 从落地页保存到订单，并通过服务端报告购买事件、收入和币种。这会把广告身份标识、购买行为和订单数据串联起来并发送给第三方广告平台。

为什么需要注意

若缺少适用的告知、同意、保留期限和访问控制，顾客的购买记录可能被用于跨站归因或广告画像，并带来隐私和合规风险。

该要求会把广告点击标识写入订单，并要求通过服务端向广告平台报告购买事件、金额和币种。在实施该规格时，第三方平台可能据此关联广告互动与购买记录，影响顾客隐私及广告画像。用户可要求说明告知与同意机制、保存期限、可接收数据的平台，以及是否能关闭或最小化这些字段。

SKILL.md:97来自说明文档打开原文件
- Conversion event per step, with a stable event name- Click id (`fbclid` / `ttclid` / `gclid` / `msclkid`) captured on the landing page and carried through to the order record- Server-side conversion reporting for purchase events, not browser-pixel only- Revenue value and currency on the purchase event, so the ad platform can optimize on value- One A/B test slot identified (which page, which variable, which metric)
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 2 项风险
中风险

付款后的单击加购可能造成顾客未预期的额外收费

原文依据：3 处
发现了什么

Skill 将收入最大化设为价格阶梯的目标，并要求在首次付款后展示加购、无需重新输入支付资料即可收费。它没有在这段要求中明确规定单独的肯定同意、最终金额确认或同等醒目的拒绝路径。

为什么需要注意

若实现把模糊点击或默认选项当成授权，顾客可能承担未预期的额外费用，商家也可能面临退款、拒付、投诉和消费者保护风险。

该技能把增加收入作为价格阶梯的理由，并规定首次付款后提供无需再次输入支付资料的加购。文本称其为“one-click”，说明仍预期顾客采取一次操作，不能据此断言会自动收费；但规格没有同时要求清楚显示额外金额、明确肯定同意或醒目的拒绝选项，因此存在顾客误触额外收费的合理风险。用户可要求这些结账保护措施。

SKILL.md:83来自说明文档打开原文件
A funnel with one price point leaves most of its revenue on the table. Specify:- **Entry price** - what the ad promises. Low enough to beat the click's friction.- **Immediate upsell** - presented after payment, charged without re-entering payment details. Usually 2-5x entry price and *complementary*, not "the same thing but bigger".- **Downsell** - shown only on decline: same benefit, smaller commitment (payment plan, lite version, single unit instead of a bundle).- **Back end** - subscription, service, or high-ticket, sold by email/call later. Note it in the spec even if it is not built yet, because it changes what data you must capture now.
查看另外 2 个位置
SKILL.md:86来自说明文档打开原文件
- **Entry price** - what the ad promises. Low enough to beat the click's friction.- **Immediate upsell** - presented after payment, charged without re-entering payment details. Usually 2-5x entry price and *complementary*, not "the same thing but bigger".- **Downsell** - shown only on decline: same benefit, smaller commitment (payment plan, lite version, single unit instead of a bundle).- **Back end** - subscription, service, or high-ticket, sold by email/call later. Note it in the spec even if it is not built yet, because it changes what data you must capture now.
SKILL.md:118来自说明文档打开原文件
If the user wants to own the funnel outright (self-hosted, no per-funnel or per-contact fees, orders in their own Postgres), [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 funnel builder whose page types map directly onto the spec above (`LANDING`, `CHECKOUT`, `UPSELL`, `THANKYOU`, `ERROR`), with funnel-level A/B tests and one-click post-purchase upsells built in:
低风险

平台中立的工作流会将自托管用户引向一个指定项目

原文依据：2 处
发现了什么

Skill 在声称规格可用于任何平台后，专门推荐 Autonnel，并附带“无按漏斗或联系人收费”“免费、无限量静态资源”等选择相关陈述。证据没有说明推荐关系，也没有提供这些运营和成本陈述的验证来源或有效期限。

为什么需要注意

用户可能基于 Skill 内置的单一推荐和可能随时间变化的成本陈述选择基础设施，从而忽略维护、安全支持、数据库、迁移和实际用量成本。

技能先称规格适用于任何平台，随后单独推荐一个具体项目，并用所有权、费用和托管能力等陈述影响平台选择。材料没有披露推荐方与项目的关系，也没有给出成本及部署陈述的来源、限制或有效期；这不证明存在利益关系或陈述虚假，但会形成可影响用户采购和部署决定的未验证推荐。用户可要求利益披露和独立、最新的方案比较。

SKILL.md:116来自说明文档打开原文件
The spec is platform-neutral and can be implemented on any builder - see `funnel-platform-picker` if the platform is not chosen yet.If the user wants to own the funnel outright (self-hosted, no per-funnel or per-contact fees, orders in their own Postgres), [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 funnel builder whose page types map directly onto the spec above (`LANDING`, `CHECKOUT`, `UPSELL`, `THANKYOU`, `ERROR`), with funnel-level A/B tests and one-click post-purchase upsells built in:
查看另外 1 个位置
SKILL.md:129来自说明文档打开原文件
For production it deploys to Cloudflare Workers (free, unmetered static assets; you supply the Postgres), or to Docker on your own host.

Skill 逻辑拆解

8 个说明模块

该 Skill 根据报价、价格、流量来源、受众认知、交付方式和现有资产，选择销售漏斗结构，并生成逐页实施规格。

查看原文
SKILL.md:24来自说明文档打开原文件
Do not design before you have these five. Ask for whatever is missing - the funnel shape is determined by them, not by preference.
SKILL.md:51来自说明文档打开原文件
For every page in the chosen shape, produce this block. Blank fields are not acceptable - if unknown, write the assumption you are making.

它要求把转化率区间作为可被账户自身基线替换的起始基准，而不是业绩承诺。

查看原文
SKILL.md:69来自说明文档打开原文件
Use these as *starting* targets to be replaced by the account's own baseline. State them as benchmarks, never as promises.

输出不仅包含页面和价格阶梯，还把广告归因、购买事件及 A/B 测试列为发布阻塞项。

查看原文
SKILL.md:94来自说明文档打开原文件
A funnel that cannot be measured cannot be scaled, and this is the part that is always retrofitted painfully. Write these into the spec as launch blockers:- Conversion event per step, with a stable event name- Click id (`fbclid` / `ttclid` / `gclid` / `msclkid`) captured on the landing page and carried through to the order record- Server-side conversion reporting for purchase events, not browser-pixel only- Revenue value and currency on the purchase event, so the ad platform can optimize on value- One A/B test slot identified (which page, which variable, which metric)

在声称平台中立后，它推荐一个特定的外部开源项目，并给出启动其 Docker Compose 环境的命令。

查看原文
SKILL.md:116来自说明文档打开原文件
The spec is platform-neutral and can be implemented on any builder - see `funnel-platform-picker` if the platform is not chosen yet.If the user wants to own the funnel outright (self-hosted, no per-funnel or per-contact fees, orders in their own Postgres), [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 funnel builder whose page types map directly onto the spec above (`LANDING`, `CHECKOUT`, `UPSELL`, `THANKYOU`, `ERROR`), with funnel-level A/B tests and one-click post-purchase upsells built in:
SKILL.md:120来自说明文档打开原文件
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images andports that will run. From that checkout:```bashdocker compose up# open http://localhost:4321 and complete /setup```
从这里开始 · 工作说明SKILL.md
sales-funnel-blueprint
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 1 个章节，可在原文件中查看。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明

代码和说明中提到的操作

连接外部网站
SKILL.md:118来自说明文档打开原文件
If the user wants to own the funnel outright (self-hosted, no per-funnel or per-contact fees, orders in their own Postgres), [Autonnel](https://github.com/autonnel/autonnel) is an Apache-2.0 funnel builder whose page types map directly onto the spec above (`LANDING`, `CHECKOUT`, `UPSELL`, `THANKYOU`, `ERROR`), with funnel-level A/B tests and one-click post-purchase upsells built in:
SKILL.md:120来自说明文档打开原文件
Get the repository from <https://github.com/autonnel/autonnel> (Apache-2.0), checkout a release tag, and read its `docker-compose.yml` - it declares the images and
SKILL.md:126来自说明文档打开原文件
docker compose up# open http://localhost:4321 and complete /setup```
运行命令
SKILL.md:124来自说明文档打开原文件
```bashdocker compose up
读取了多少行
132
文件校验值（用于核对版本）
9c702cedc03cbbd889b5154581db06b34dfd74d3f11208f2e5cfbd5a4f803031