Security audit
Security checks for vulnerabilities and agentic risk
This voice-review skill is mostly purpose-aligned, but it can be invoked by very broad triggers and can silently change and save text, so it should be reviewed before installation.
Install only if you want a voice-review skill that may automatically edit hard-fail patterns and save reviewed text. Prefer explicit invocation, review diffs before publishing, and check or disable learning snapshots if the reviewed text may contain private or sensitive content.
Using the trigger "review" conflicts with a likely built-in command of the same name, creating shadowing and ambiguous dispatch behavior. In context, this is especially risky because the skill can launch agents, auto-modify text, and save artifacts, so users may invoke it when they intended a trusted built-in review flow.
The trigger list contains broad, generic activators like "voice," "review," "prose," "craft," and "quality," which are likely to match ordinary user intent and unintentionally invoke this skill. That creates a prompt-routing and command-confusion risk, especially because the skill can modify text and write outputs as part of its normal flow.
The skill states that hard failures are auto-fixed silently, meaning content may be changed without clear advance consent or a review gate before modification. Silent edits are dangerous because they can alter meaning, introduce integrity issues, and surprise users in workflows involving publication or regulated content.
The skill persists reviewed text snapshots to a local directory under the user's home folder without a clear privacy notice, retention policy, or consent flow. This can expose sensitive generated or reviewed content to unintended local access, backup systems, or later reuse beyond the user's expectation.
No suspicious patterns detected.
