Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a simple local reference script, but it is advertised as zkSync-specific while providing generic placeholder guidance that could mislead users.
Install only if you understand this is not a reliable zkSync reference. It does not appear to perform unsafe local actions, but its content is under-scoped and should not be used for blockchain, financial, compliance, deployment, bridging, wallet, or smart-contract decisions without independent authoritative sources.
The skill advertises itself as a zkSync reference tool, but the documented commands and descriptions are largely generic finance/compliance placeholders rather than zkSync-specific guidance. This is dangerous because users may rely on the skill for blockchain decisions under a false assumption of domain specificity, leading to incorrect operational, security, or compliance actions in a financial context.
The file header and help text explicitly present the script as a zkSync reference tool. In practice, the implementation only prints generalized, reusable reference prose with placeholders like 'specialized tool/concept in the blockchain domain,' which contradicts the stated intent of providing actual zkSync reference information.
The manifest says this skill should be used when working with zksync in blockchain contexts, implying domain-specific reference functionality. However, the commands output broad boilerplate text about formulas, regulations, risks, instruments, and checklists that is largely generic and not meaningfully tied to zkSync or even concrete blockchain operations.
No suspicious patterns detected.
