Security audit
Security checks for vulnerabilities and agentic risk
The skill is only a Markdown prompt and contains no code, but its brand-narrative purpose is broadened into general business decision support while asking for business data and documents without clear limits.
Review this skill before installing. Use it only for brand tone, messaging, narrative, and naming work, and avoid pasting confidential contracts, regulated records, personal data, secrets, full internal strategy documents, or unnecessary financial/vendor details. Redacted summaries should be enough for its stated purpose.
The skill description and early prompting are so broad that activation boundaries are unclear. Ambiguous scope increases the likelihood that the agent will apply this skill to inappropriate requests or collect unnecessary sensitive information under the guise of general business support.
The skill claims to perform brand-narrative work, but its overview and use cases describe broad business optimization and operational decision support. This mismatch can cause the skill to be invoked in contexts far beyond its intended scope, leading users to provide unrelated sensitive business data and increasing the chance of unsafe or misleading outputs.
The skill asks users to paste business context, data, and documents but does not warn against sharing confidential, regulated, or unnecessary sensitive information. In this context, that omission is dangerous because the skill's broad framing invites submission of internal strategy, vendor, regulatory, or stakeholder materials that may not be needed for brand work.
The output section promises generic deliverables such as scripts or plans, which are not specific to brand narrative generation. This broadens user expectations and can encourage use of the skill for unrelated tasks, weakening scope controls and making accidental misuse more likely.
No suspicious patterns detected.
