Security audit
Security checks for vulnerabilities and agentic risk
This skill is a harmless static shell reference tool in execution, but its Tendermint branding does not match its mostly generic finance and compliance content.
Review this carefully before installing if you need Tendermint help. It does not appear to steal data or change the system, but it should not be trusted as a Tendermint blockchain reference unless the publisher replaces the generic finance/compliance text with accurate Tendermint-specific material or renames the skill to match what it actually provides.
The skill is presented as a Tendermint-specific blockchain reference tool, but its documented functionality is mostly generic finance, regulation, risk, and strategy content. This mismatch can mislead users or downstream agents into invoking the skill in trusted blockchain contexts and receiving irrelevant or inappropriate guidance, increasing the chance of bad operational or compliance decisions.
The inline description and help text claim this is a Tendermint reference tool, but the implementation contradicts that claim with unrelated business/finance content. In an agent skill ecosystem, this kind of capability misrepresentation is dangerous because it can silently poison workflows with authoritative-looking but irrelevant information.
The script is presented as a Tendermint blockchain reference tool, but the exposed commands provide generic finance, compliance, and risk text unrelated to Tendermint. This is a trust-boundary violation: users or downstream agents may rely on the declared capability and receive misleading domain guidance, causing incorrect operational or security decisions in blockchain contexts.
The manifest and branding assert a Tendermint reference capability, but the command set documents unrelated generic topics such as regulations, instruments, and strategies rather than Tendermint-specific blockchain operations. In an agent ecosystem, deceptive or inaccurate capability descriptions are dangerous because they can cause incorrect tool selection, misplaced trust, and unsafe decisions based on non-domain-specific output.
No suspicious patterns detected.
