Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed codebase-knowledge extractor that reads the project and writes a local `.gauntlet/knowledge.json` file, with no evidence of deception, exfiltration, or destructive behavior.
Install only if you want the agent to inspect the selected codebase and maintain a `.gauntlet/knowledge.json` file. Review that generated file before committing it, especially in private or proprietary repositories, because it may summarize sensitive architecture or business logic.
The trigger condition is very broad: 'initializing or refreshing codebase knowledge for challenges' can plausibly activate during routine repository work without a narrowly scoped user request. Because the skill performs extraction and later writes workspace artifacts, broad activation increases the chance of unintended execution of filesystem-modifying behavior.
The skill instructs the agent to write .gauntlet/knowledge.json and merge annotations without any explicit warning, confirmation step, or safety boundary around modifying project files. In an agent setting, this can lead to silent workspace changes, accidental overwrites, or persistence of AI-generated content into the repository when the user may have expected read-only analysis.
No suspicious patterns detected.
