Security audit
Security checks for vulnerabilities and agentic risk
This skill is a low-risk prompt aid that asks clarifying questions before planning work, with no code execution, data access, persistence, or hidden behavior found.
Installers should expect this skill to sometimes slow down vague requests by asking for goals, constraints, and success criteria before proposing a solution. That behavior is intentional and low risk, but users who prefer strictly explicit activation may want narrower trigger settings.
The manifest metadata sets language: en, which indicates a fixed language choice. The file does not offer the user a language/locale choice or explain why an English-only constraint is necessary, creating a natural-language policy concern under the language/locale rule.
This markdown file defines invocation examples such as "Help me build an agent," "Make a dashboard for this," and "We need a better process," which are common phrases that could appear in many ordinary conversations. The skill gives no negative examples or tighter constraints on when it should not activate, so the trigger scope is ambiguous and may cause unintended invocation.
This manifest file describes invocation behavior, so vague-trigger checks apply. The phrase "Use $goal-clarifier to clarify the real goal" is not narrowly scoped to a specific context or explicit trigger list, which can make activation conditions ambiguous and increase the chance of unintended invocation when users ask for general clarification.
No suspicious patterns detected.
