Security audit
Security checks for vulnerabilities and agentic risk
This skill gives disclosed guidance for deciding when an agent should ask clarifying questions, and it does not include code, persistence, credential access, or hidden data handling.
Install this only if you want your agent to ask fewer clarifying questions in low-risk, clear tasks. Keep stronger confirmation requirements for deletion, deployments, credentials, production data, security-sensitive work, migrations, or anything with irreversible impact.
The skill registers on very broad triggers like 'efficiency', 'workflow', and 'decision-making', which are common across many ordinary requests. That increases the chance this skill activates in contexts where autonomous action guidance is inappropriate, potentially suppressing needed clarification before risky actions.
This section explicitly encourages proceeding autonomously when certain subjective conditions are met, such as a 'standard approach' or presumed reversibility. In practice, those judgments can be wrong, causing the agent to take actions the user did not intend, especially in security-sensitive or operationally risky tasks.
- [ ] No clear standard approach exists
- [ ] User context doesn't clarify intent
## When to Proceed Without Asking
### Default to Action For
The checklist normalizes 'proceed without asking' based on assumptions like reversibility and reviewability, but review after the fact does not prevent harmful or unintended execution. This is particularly dangerous because the skill is designed to reduce clarifying questions, making under-questioning more likely in edge cases where ambiguity affects correctness or safety.
### Proceed Threshold Checklist
Proceed without asking if:
- [ ] Standard/obvious solution exists
- [ ] Easily reversible (git, backup)
- [ ] User can review before finalize
No suspicious patterns detected.