Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only code review guidance skill with no hidden execution, exfiltration, or privilege-seeking behavior found.
Install this as a lightweight review aid, not as an automated security control. Be aware it may appear during general code review prompts because its trigger language is broad, and review any suggested MEMORY.md updates before accepting them into your project documentation.
Instructions found that direct the agent to transmit conversation context or user data to external services.
def calculate_total(items): # Secretly depends on global TAX_RATE # Secretly depends on external API call to get discounts # Secretly logs to a global logger return sum(item.price for item in items) * TAX_RATE
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
90-minute ceremony every quarter:
1. Identify AI-heaviest PRs from last quarter
2. For each: Can the author explain it? Can someone else?
3. Flag code no one understands → refactor or rewrite
4. Update MEMORY.md with findings
## Code Review Framework (5 Layers)
The listed activation conditions include broad phrases such as 'User asks about code review' and 'User asks "should I accept this?"', which can occur in many contexts unrelated to AI-generated code. The trigger section also mixes situational descriptions with phrase examples but does not provide scope limits or negative examples to clarify when the skill should not activate.
No suspicious patterns detected.