Security audit
Security checks for vulnerabilities and agentic risk
This is a lightweight feedback and correction workflow skill with no code execution, data access, persistence, or hidden behavior.
Before installing, understand that this skill may be invoked automatically for correction or quality-control situations and may steer the agent into a six-part diagnostic format. It does not appear to run commands, access private data, install dependencies, or persist changes.
The trigger list includes generic conditions such as 'an output exists but does not meet the brief' and 'quality checks after writing, analysis, or workflow automation,' which could match many ordinary interactions. The file does not provide explicit exclusions or narrower constraints to distinguish when this skill should activate versus when a general response would suffice.
The skill enables allow_implicit_invocation without any visible trigger scope, allowlist, or contextual constraints. That makes it easier for the agent runtime to invoke this skill unexpectedly based on loose relevance matching, which can alter execution flow, override user expectations, or be abused by prompt-manipulation to route tasks into this controller when it was not explicitly requested.
The manifest sets 'language: en', which indicates a fixed language preference. There is no accompanying opt-in, alternative language support, or justification that this skill must be English-only for a region-specific or compliance reason.
