Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent reporting skill that reads GEO audit files and writes progress reports, with some scoping and data-quality caveats but no evidence of hidden or malicious behavior.
Install only if you want an agent to work with local GEO audit files and generate client-facing reports. Review outputs before sharing with clients, especially any inferred scores or business-impact estimates, and be aware that reports may be written into ~/.geo-prospects/reports.
The manifest says to use the skill when the user says "compare", "delta", "monthly report", or "progress", several of which are generic phrases that can occur in many unrelated conversations. Although some examples are domain-specific, the trigger list itself lacks clear scope constraints or negative examples, increasing the risk of unintended invocation.
The skill contains contradictory operating instructions: one section tells the agent to run a fresh audit when only one prior audit exists, while the tooling section says comparison must fail when fewer than two audits exist. This inconsistency can cause the agent to take unexpected actions, produce misleading delta reports from mixed data sources, or run extra commands the user did not clearly request.
The skill claims to compare two audits but also authorizes estimating missing scores from narrative text, which permits subjective or invented values to enter a supposedly quantitative report. This can mislead clients, hide data quality problems, and cause the agent to fabricate measurements instead of failing safely when structured inputs are incomplete.
The skill instructs writing reports to a fixed filesystem location without warning about file creation or overwrite behavior. In an agent setting, silent writes can create privacy, integrity, or surprise-action issues, especially if reports contain client-sensitive business data or if an existing report is replaced.
No suspicious patterns detected.
