Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent local KPI-tracking skill that writes KPI data and optional reports in the workspace, with no executable code or hidden network behavior found.
Install only in workspaces where local storage of KPI and business performance data is acceptable. Use explicit requests for recording data or saving reports, and review any cron or messaging integrations yourself before adding automation.
The phrase "how are we doing?" is common everyday language and is presented as a way to invoke the skill without any narrowing context or exclusion conditions. Because the README does not constrain when this phrase should activate, it risks accidental triggering outside KPI-related interactions.
The trigger phrases such as 'Track these KPIs' and 'Give me a KPI report' are broad enough to overlap with ordinary conversation, increasing the chance the skill activates unintentionally. Accidental activation could cause the agent to read configuration files or write KPI data/reports without the user intending to invoke persistent file operations.
The example 'Record MRR at $42,000 for this week' is phrased like natural business conversation rather than a clearly scoped command. In an agent environment, that ambiguity can lead to unintentional state changes by causing persistent writes to kpi-data.json based on casual discussion or quoted text.
The report and trend-analysis phrases are underspecified and can be triggered by normal requests discussing KPIs, trends, or reports. Because these actions involve reading historical files and optionally creating report artifacts, ambiguous invocation increases the risk of unintended file access and output generation.
The skill explicitly stores entries in kpi-data.json and may save reports, but it does not clearly warn users that activating these features will modify files in the workspace. That lack of transparency is dangerous because users may not realize business data is being persisted locally, which can create integrity, privacy, or auditability issues.
The skill's stated purpose is local KPI tracking, reporting, and trend analysis using workspace JSON files and optional markdown reports. Line L92 directs users to an external website for 'Context Packs,' which is not part of the documented KPI-tracking functionality and introduces an unjustified external-network-oriented capability into the skill documentation context.
No suspicious patterns detected.
