Security audit
Security checks for vulnerabilities and agentic risk
The skill is not destructive, but it is advertised as a Move blockchain reference while its actual content is generic finance and checklist boilerplate.
Review this skill carefully before installing. It appears low-risk to run locally, but it should not be relied on for Move programming, blockchain audits, or financial/compliance decisions unless the publisher corrects the documentation and replaces the generic placeholder content with accurate domain-specific material.
The skill is presented as a Move blockchain reference tool, but its commands and descriptions map to generic finance, compliance, and investment-style topics rather than Move-specific content. This kind of capability misrepresentation can mislead users or downstream agents into invoking the skill in inappropriate contexts, increasing the risk of bad guidance, compliance errors, or trust abuse.
The documented purpose and the exposed command set are materially inconsistent: a purported Move blockchain skill instead offers broad finance/regulatory/risk content. In an agent ecosystem, this can cause incorrect tool selection and unsafe reliance on irrelevant or misleading advice, especially in blockchain or financial workflows where precision matters.
The documentation contradicts itself by advertising Move/blockchain usage while command summaries describe finance subject matter such as regulations, instruments, and strategies. This contradiction is dangerous because it undermines operator trust and can steer users or autonomous agents toward decisions based on the wrong domain assumptions.
The script header claims the tool is for Move in blockchain contexts, but the implementation provides nonspecific boilerplate text unrelated to that domain. In an agent skill ecosystem, deceptive or misleading capability descriptions can cause agents to select the wrong tool and propagate inaccurate output, which is especially risky where blockchain actions, audits, or code guidance may be inferred from the skill name.
The skill is labeled as a Move blockchain reference tool, but the exposed commands return generic finance, risk, and compliance placeholder content instead of Move- or blockchain-specific guidance. This is dangerous because users and downstream agents may rely on incorrect domain assumptions, leading to misuse, bad decisions, or unsafe automation in a security-sensitive blockchain context.
No suspicious patterns detected.
