Security audit
Security checks for vulnerabilities and agentic risk
This skill is benign: it implements a disclosed local approval ledger and lock helper for human-reviewed actions, without hidden network calls or automatic execution.
Install only if you want a local approval state file for workflows that may create records, drafts, payments, or similar changes. Choose state and lock paths deliberately, protect the approval secret, and prune old applied items only after your reconciliation lookups no longer need them.
The skill explicitly describes file read/write behavior via a local JSON state file, lock sidecar, and per-application lock files, but it does not declare any tool scope such as permissions or allowed-tools. That mismatch can let an agent invoke filesystem-capable tools without an explicit contract, weakening least-privilege controls and making unintended local state modification more likely.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
| "the job timed out, did it create the record?" | §4: reconcile, never re-run the creation |
| "two runs of the cron hit the same app" | §5: run lock |
| "the agent only prepares drafts, a human sends them" | §6: `regime="draft_only"`, filter in code |
| Auditing an existing approval flow | Fill the Output Format, one row per rule |
## States and named gates
No suspicious patterns detected.