Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Docs pipeline generator that reads optional local JSON input and writes a user-specified output artifact.
Installers should understand that running the helper script can create parent directories and overwrite the output file they provide. Avoid pointing --output at important existing files, and do not rely on --dry-run to prevent writes unless the script is fixed.
The skill references executable helper resources and implies file read/write behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. That gap weakens least-privilege controls and can allow broader filesystem access than reviewers or runtime policy expect, especially in an automation workflow that reads sources and exports generated artifacts.
This code writes generated content to the user-supplied output path, which is a file-modifying operation covered by the missing-warning rule for code files. While the CLI argument names indicate an output path, there is no confirmation prompt, log/print message, or inline comment/docstring disclosing that the script will create or overwrite an artifact at that location.
The markdown branch performs a filesystem write to the specified output path, but the script provides no user-facing notice, confirmation, or explanatory documentation for this side effect. For code files, file writes should have at least some visible disclosure unless already clearly documented elsewhere.
This branch opens the output path for writing and emits CSV data, which is a file write side effect. The script contains no confirmation prompt, logging, or explanatory documentation warning the user that running it will create or overwrite the destination file.
No suspicious patterns detected.
