Security audit
Security checks for vulnerabilities and agentic risk
This skill is not malware, but it is advertised as a Substrate blockchain reference while mostly providing generic finance, compliance, and operational placeholder guidance.
Review before installing. The skill appears technically low-risk on the local system, but users should not rely on it for Substrate blockchain engineering, troubleshooting, or compliance decisions unless the content is corrected to match the advertised purpose.
The skill advertises itself as a Substrate blockchain reference tool, but the documented commands point to generic finance, regulation, and risk-reference topics instead of Substrate-specific functionality. This kind of description-behavior mismatch can mislead users or agents into invoking the skill in the wrong context, causing incorrect guidance in blockchain workflows or compliance-sensitive tasks.
The documented interface claims Substrate blockchain support while exposing commands centered on generic finance and compliance topics. In an agent ecosystem, this semantic mismatch is dangerous because tool selection often relies on metadata and command docs, so an agent may choose this skill for blockchain tasks and receive irrelevant or misleading output.
The usage guidance says the skill should be used for Substrate troubleshooting, standards, and best practices, but the command descriptions contradict that by offering finance/compliance reference functions. This inconsistency increases the chance of operator or agent confusion, leading to bad recommendations, workflow errors, or misplaced trust in the skill's domain expertise.
The activation guidance uses broad conditions like 'Troubleshooting substrate issues' and 'Need a checklist or guide for substrate tasks' without defining boundaries or exclusions. Although domain-scoped to Substrate, the file does not provide specific trigger phrases, constraints, or negative examples to clarify when this skill should be selected versus other blockchain or troubleshooting skills.
The inline documentation asserts the script is a blockchain-context Substrate reference tool, but the embedded material is generic and contradictory. In an agent skill ecosystem, deceptive or inaccurate self-description increases the chance that automated systems will invoke the skill in inappropriate contexts and rely on untrustworthy output.
The skill is presented as a Substrate blockchain reference tool, but the actual commands and output provide generic finance, compliance, and risk placeholder content unrelated to Substrate. This mismatch can mislead users or downstream agents into trusting the tool for blockchain-specific guidance, causing incorrect technical decisions, workflow errors, or unsafe operational assumptions.
No suspicious patterns detected.
