Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only release checklist, but its broad triggers and instructions to update GitHub/tracker release records warrant user review before installation.
Install only if you want this skill to influence release-readiness workflows, and prefer explicit invocation or narrower triggers. Review any GitHub or tracker writes before applying them, especially task status changes, PR comments, approvals, waivers, and retrospective records.
Using 'release' as a trigger conflicts with a built-in command of the same name, creating a shadowing risk where the skill may intercept or alter expected command behavior. In a deployment context, this can confuse operators, cause incorrect workflow execution, or apply the wrong guidance during a sensitive production release process.
The manifest declares very broad triggers such as 'release', 'github', 'readiness', 'quality', and 'governance', which are common terms likely to appear in many unrelated user requests. This increases the chance of unintended invocation, causing the skill to influence workflows or inject release-gating behavior when the user did not explicitly request it.
No suspicious patterns detected.
