Security audit
Security checks for vulnerabilities and agentic risk
This is a broad full-stack development guidance skill with no executable code, persistence, credential access, or hidden runtime behavior.
Before installing, consider that this skill is intentionally broad and may influence most web-application development tasks. Its guidance is conventional and disclosed, but users who prefer narrower task routing may want a more specialized skill for specific frameworks or domains.
The skill description explicitly says to use this skill for 'ANY web application' and for broad actions like build, fix, review, architect, or debug. That trigger scope is so broad that it can activate on a large fraction of normal developer requests, increasing the chance the skill overrides more specific safety-reviewed skills or captures unrelated tasks with higher-risk tool usage.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
GET /api/v1/users/:id → Get single user
PUT /api/v1/users/:id → Full update
PATCH /api/v1/users/:id → Partial update
DELETE /api/v1/users/:id → Soft delete (set deleted_at)
Always version your APIs: /api/v1/...
Always return consistent response shape:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│ ├── services/ # Business logic (not React-specific) │ └── types/ # TypeScript types ├── prisma/schema.prisma ├── .env.local └── docker-compose.yml
No suspicious patterns detected.