Security audit
Security checks for vulnerabilities and agentic risk
This project-tracking skill creates and updates local Markdown project records as expected, with no evidence of hidden code, network access, credential use, or destructive behavior.
Install this only if you want the agent to maintain local project-tracking files. To avoid noisy or unintended files, use explicit commands such as asking it to create or update a specific project entry, and review generated project records before relying on them or storing sensitive business details.
The skill directs the agent to create and update files in the local workspace but does not prominently require user awareness or consent at the moment of modification. This is dangerous because routine use of the skill can silently alter repository contents, leading to unintended file creation, noisy diffs, or accidental persistence of sensitive project details.
The instruction 'When the user mentions a new project, create projects/.md' is an overly broad trigger that can cause the agent to create files from casual conversation rather than an explicit user request. In a file-writing skill, this creates a real risk of unintended local state changes, clutter, and incorrect project records based on ambiguous mentions.
No suspicious patterns detected.
