Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only coding-discipline guide that encourages clarification, small edits, and verification, with no hidden execution, persistence, or data access found.
Expect this skill to add planning, assumptions, TodoWrite checklist items, and verification criteria around coding tasks. If you want it only on explicit request, narrow the broad triggers before installing; treat the referenced external plugin and related skills as separate items to review.
The trigger "starting implementation to verify the approach" is a broad natural-language phrase that could appear in ordinary discussion rather than as an intentional skill invocation. The file does not provide tighter activation constraints or negative examples to distinguish deliberate invocation from incidental mention.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
> The models make wrong assumptions on your behalf and
> just run along with them without checking. They don't
> manage their confusion, don't seek clarifications,
> don't surface inconsistencies, don't present
> tradeoffs, don't push back when they should.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
This example illustrates AP-8 (Multi-Step Plan
Without Verification Gates): each step gets its own
reformulation, its own success signal, its own test.
## Why This Works
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
This example illustrates AP-8 (Multi-Step Plan
Without Verification Gates): each step gets its own
reformulation, its own success signal, its own test.
## Why This Works
No suspicious patterns detected.