Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward workflow checkpointing guide, but users should avoid storing sensitive task details in its persistent checkpoint files.
Install only if you want agents to write local checkpoint files for multi-step work. Do not checkpoint secrets, credentials, private customer data, sensitive outputs, or internal host details, and periodically delete old files under memory/checkpoints.
The skill directs checkpointing for "every multi-step workflow," which is overly broad and can cause routine persistence of workflow state, outputs, and artifact paths even when unnecessary. In practice this increases the chance that sensitive operational details, partial outputs, or environment metadata are written to disk and later exposed or reused inappropriately.
The checkpoint format explicitly stores outputs, errors, timestamps, and artifact paths on disk under memory/checkpoints, but the skill does not prominently warn that this creates persistent local records. That omission can lead users or agents to serialize sensitive workflow results, internal paths, host addresses, or operational errors into files that may outlive the session and be readable by other processes or users.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
❌ Don't save checkpoints for single-step tasks
❌ Don't save sensitive data in checkpoint files
❌ Don't skip verification when resuming
❌ Don't forget to clean up old checkpoints
## License
No suspicious patterns detected.