Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed project-execution workflow guide, with expected local task tracking and testing instructions but no hidden code or unsafe install behavior.
Install this when you want an agent to follow a structured implementation workflow. Expect it to edit project files, run tests or quality commands, and write local Attune progress state when invoked; avoid using it for casual coding prompts unless you intend that workflow.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- [ ] Code linted (no warnings)
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- ✅ All acceptance criteria met
- ✅ All tests written and passing
- ✅ Code reviewed (self or peer)
- ✅ Linting passes with no warnings
- ✅ Type checking passes (if applicable)
- ✅ Documentation updated
- ✅ No known regressions
The trigger terms are broad enough that the skill may activate during generic development conversations, causing the agent to adopt an execution-oriented workflow when the user did not explicitly request it. In an agent ecosystem, overbroad activation can lead to unintended repo actions, task-state mutations, or workflow hijacking because this skill encourages implementation, testing, status updates, and checkpoint persistence.
The manifest frames this skill around implementation execution, progress tracking, checkpoint validation, and quality gates. The documented workflow also introduces source-control manipulation capabilities such as requiring a git repository and optionally creating feature branches, which are not explicitly justified by or declared in the stated scope of the skill.
The manifest describes an execution skill centered on implementing plans, tracking progress, validating checkpoints, and enforcing quality gates. Large portions of the file define formal reporting artifacts and management-style communications, which are ancillary project-management capabilities not clearly justified by the narrow execution purpose stated in the manifest.
No suspicious patterns detected.