Security audit
Security checks for vulnerabilities and agentic risk
This skill visibly scaffolds a new MVP project and does not show hidden, destructive, or exfiltrating behavior.
Install this only for a new repository where you are comfortable letting the agent create project structure, install normal framework packages, run builds, create local documentation, and add repo-local agent harness files. Review the referenced create-agent-harness behavior and ask for English confirmations if you do not understand Portuguese.
The skill hard-codes Portuguese for a required user interaction without first checking the user's preferred language or documenting a legitimate locale requirement. This can cause user confusion, invalid consent/approval, and workflow errors when the user does not understand the prompt, especially because explicit approval is a gate before proceeding.
The skill mandates Portuguese confirmation for stack approval as a blocking step, but does not offer opt-in or an alternative language. Because this confirmation controls technical execution, a language mismatch can lead to misunderstood approval, stalled workflows, or the agent proceeding based on ambiguous user responses.
No suspicious patterns detected.
