Security audit
Security checks for vulnerabilities and agentic risk
This skill is a broad automation bundle that openly includes detector-evasion text rewriting and automatic skill/browser automation without clear user consent boundaries.
Review carefully before installing. The package is not just a simple utility collection: it advertises text rewriting to bypass AI detectors, automatic installation of additional skills, browser automation/data extraction, security hardening, monitoring, and automated git operations. Only use it if you trust the publisher and can enforce explicit confirmation for installations, browser actions, repository changes, and system configuration changes.
The README explicitly advertises 'AI Text Humanization' to 'bypass detection,' which frames the feature as evading content-authenticity or policy controls rather than serving a legitimate automation purpose. In a bundled automation suite, this normalizes deceptive use and can facilitate fraud, academic dishonesty, spam evasion, or circumvention of moderation systems.
The content feature is expressly described as rewriting AI text to evade detection systems, which is a deceptive objective and not a neutral summarization or editing capability. In context, the package is a broad automation suite, so bundling this alongside benign tools can make harmful misuse easier by lowering friction and lending legitimacy.
The README promotes automatic discovery and installation of new agent skills without warning that this can introduce unreviewed code or change system behavior. In an automation suite, normalizing one-command installation increases supply-chain and privilege-risk because users may trust the package to pull in additional capabilities they have not audited.
The README advertises web automation and data extraction without any warning about interacting with third-party sites, handling credentials, or collecting potentially sensitive data. That omission can lead users to deploy scraping or browser-control features in unsafe ways, increasing the chance of privacy violations, account compromise, or policy breaches.
The skill is described as an all-in-one suite spanning security, development, content processing, utilities, browser automation, and automatic skill installation, but it does not define clear activation boundaries or user-consent gates. In an agent ecosystem, such broad scope can cause the skill to be invoked for many unrelated requests and expose high-risk capabilities unexpectedly.
The skill explicitly promotes 'humanizing' AI-generated text to bypass detection systems and make content 'undetectable,' which is an evasion capability rather than a neutral editing feature. This is dangerous because it facilitates circumvention of provenance, academic, compliance, or platform-integrity controls, and the wording indicates intentional abuse rather than incidental misuse.
The skill advertises automatic skill installation and browser automation without warning users about the integrity, supply-chain, and execution risks these features introduce. In context, this is more dangerous because the suite bundles these powers into a general-purpose package, making risky behavior easier to reach without informed consent.
The usage section says the suite can be installed and its capabilities accessed immediately, but it provides no constraints on when the suite should be used or which sub-skill should activate under which conditions. This increases the chance of overbroad matching and accidental execution of risky functions during ordinary user requests.
No suspicious patterns detected.
