Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Markdown workflow for generating E2E test-plan YAML, with no hidden executable payload or persistence found.
Install is reasonable for generating QA test plans. Before running any generated plan, review its commands and use a disposable or test environment because E2E steps may start services, mutate databases, and save screenshots.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
grep -E "^PORT=" .env .env.example .env.local 2>/dev/null
grep -A2 "ports:" docker-compose.yml 2>/dev/null
grep -E "port:" vite.config.ts vite.config.js 2>/dev/null
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
grep -E "^PORT=" .env .env.example .env.local 2>/dev/null
grep -A2 "ports:" docker-compose.yml 2>/dev/null
grep -E "port:" vite.config.ts vite.config.js 2>/dev/null
This is a manifest/markdown-scoped trigger issue because the description is a broad capability statement ('Analyze repo, detect stack, trace changes... generate...') rather than a narrowly scoped invocation phrase or constrained activation condition. Without explicit trigger phrases, exclusions, or context limits, the skill could be matched in many common repo-analysis requests and invoked unintentionally.
The skill’s hard gate explicitly requires YAML validation that parses the file and verifies all four required top-level keys are present, warning that a single grep alternation is insufficient. However, the later verification step uses grep -E "^version:|^metadata:|^setup:|^tests:", which will succeed if any one key is present and can therefore falsely mark an incomplete or malformed plan as verified. In this context, the inconsistency undermines the safety/quality gate for an autonomous agent that may proceed based on retrievable evidence.
This markdown reference instructs generation of test steps that can create workflow rows in PostgreSQL and later capture browser screenshots to disk, but it does not include any warning about modifying real data or storing captured UI evidence. Under the markdown-file criteria, user-facing documentation should warn when behavior may affect user data, privacy, or system integrity.
No suspicious patterns detected.