Security audit
Security checks for vulnerabilities and agentic risk
This skill is mostly a disclosed knowledge-intake workflow, but it defaults to publishing stored knowledge to GitHub and can route ingested material into code, skill, and agent changes.
Install only if you are comfortable with a knowledge workflow that can persist local corpus entries and, for high-scoring items, may publish summaries and metadata to GitHub Discussions using your current gh authentication. Treat GitHub promotion and skill/agent/code updates as actions requiring explicit review, and avoid using auto-accept on private or sensitive material.
SKILL.md:178Default GitHub Discussion Promotion Can Disclose Sensitive Knowledge-Corpus Data
The skill explicitly authorizes self-modifying behavior by instructing updates to skills, modules, and agents based on ingested knowledge. Because the source material is external and potentially adversarial, allowing it to drive modifications to the agent's own behavior or tooling creates a high-risk path for prompt injection persistence, policy drift, and supply-chain style contamination.
- Workflow optimizations
- Learning/evaluation methods (like Franklin Protocol)
**Action**: Update skills, create modules, enhance agents
### Routing Decision Tree
The trigger terms are broad and ambiguous, including generic concepts like intake, evaluation, curation, and papers/docs, making accidental activation likely during normal conversation. Broad auto-matching increases the chance that the skill will fetch external resources or process local files when the user did not intend to initiate persistent knowledge-ingestion behavior.
The skill description and early workflow framing do not prominently disclose that operation may retrieve remote URLs, read local file paths, convert documents, and persist results into long-term storage. This missing transparency is security-relevant because users may provide links or paths without understanding the data-movement and retention consequences.
The skill directs the agent to publish curated knowledge to GitHub Discussions via GraphQL as a default action for high-scoring entries, which expands behavior from intake/storage into external network publication. This creates a real boundary-crossing risk because externally sourced or user-provided content may be reposted to third-party systems, potentially disclosing sensitive project context or causing unintended public publication.
The documented routing allows knowledge-intake to trigger codebase updates and meta-infrastructure changes, including updating skills, creating modules, and enhancing agents. That exceeds a passive ingestion role and creates a capability-expansion risk where untrusted external content can influence code, docs, or agent behavior beyond mere storage.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
The marginal value filter respects autonomy levels (see plan Phase 4):
- **Level 0**: ALL decisions require human approval
- **Level 1**: Auto-approve 85+ scores in known domains
- **Level 2**: Auto-approve 70+ scores in known domains
- **Level 3**: Auto-approve 60+, auto-reject obvious noise
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
The marginal value filter respects autonomy levels (see plan Phase 4):
- **Level 0**: ALL decisions require human approval
- **Level 1**: Auto-approve 85+ scores in known domains
- **Level 2**: Auto-approve 70+ scores in known domains
- **Level 3**: Auto-approve 60+, auto-reject obvious noise
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
The marginal value filter respects autonomy levels (see plan Phase 4):
- **Level 0**: ALL decisions require human approval
- **Level 1**: Auto-approve 85+ scores in known domains
- **Level 2**: Auto-approve 70+ scores in known domains
- **Level 3**: Auto-approve 60+, auto-reject obvious noise
The automation section promotes an --auto-accept mode that creates entries and appends audit logs in the main corpus, but it lacks a prominent warning that these are persistent mutations. This is dangerous because it normalizes unattended writes to durable knowledge stores from externally sourced material, increasing the risk of pollution, leakage, and hard-to-review changes.
The module defaults to publishing corpus content to GitHub Discussions without an explicit warning that this may expose internal knowledge, source URLs, tags, file paths, and timestamps to a potentially public audience. In a knowledge-ingestion workflow, users may treat corpus entries as internal working material, so a default-public promotion step creates a real risk of unintended data disclosure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Never Assume
Even with clear staleness indicators:
- **Don't** archive without asking
- **Don't** deprecate without approval
- **Don't** delete under any circumstances without explicit permission
- **Don't** assume the curator wants to tidy
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Even with clear staleness indicators:
- **Don't** archive without asking
- **Don't** deprecate without approval
- **Don't** delete under any circumstances without explicit permission
- **Don't** assume the curator wants to tidy
No suspicious patterns detected.