Security audit
Security checks for vulnerabilities and agentic risk
This skill is not malicious, but it defines governance for high-impact AI workflows while allowing confidence-based auto-execution and persistent organizational memory without enough hard limits.
Review and tighten this skill before operational use: require human approval for destructive, financial, personnel, public-facing, or externally consequential actions; restrict any auto-execution to low-risk reversible tasks; and define approved memory stores, data boundaries, retention, redaction, and audit rules.
The 'Use this skill when' section lists broad situations like addressing trust, burnout, accountability diffusion, or designing governance frameworks, but does not define explicit trigger phrases, scope boundaries, or exclusion cases. In a markdown skill description, this ambiguity can cause unintended invocation across many ordinary management or organizational discussions.
The skill authorizes agents to 'Auto-execute' actions above a confidence threshold, treating model confidence as sufficient grounds for autonomous action within scope. Confidence is not a reliable safety control by itself, and in a high-stakes organizational governance setting this can enable unreviewed decisions or actions based on flawed reasoning, bad inputs, or miscalibrated self-assessment.
| Confidence Level | Action | Rationale |
| :--- | :--- | :--- |
| **> 90%** | Auto-execute | High confidence; agent proceeds within its authorized scope. |
| **70% - 90%** | Human review | Moderate confidence; agent presents its analysis and recommendation to a human DRI for approval. |
| **< 70%** | Escalate / Reject | Low confidence; agent escalates to a senior DRI or rejects the task. |
The deliberation record schema normalizes 'auto-executed' as an accepted routing outcome, reinforcing the same unsafe autonomous-action pattern in machine-readable form. Because schemas shape downstream implementations, this can institutionalize unreviewed execution paths and make risky autonomy easier to integrate into agents and workflows.
"properties": {
"score": { "type": "number", "minimum": 0.0, "maximum": 1.0 },
"factors": { "type": "array" },
"routing_action": { "type": "string", "enum": ["auto-executed", "human-reviewed", "escalated"] }
}
},
"limitations": { "type": "array", "items": { "type": "string" } },
The skill explicitly recommends querying persistent storage such as a Vector Store or Graph DB for historical context without any accompanying privacy, access-control, retention, or data-minimization guardrails. In an organizational management skill, that can lead agents to retrieve sensitive employee, project, or governance data across sessions, increasing the risk of over-collection, cross-context disclosure, and unintended exposure.
L214 states burnout is indicated when a pulse survey score rises above 3.5/5, while the orchestrator's culture thresholds at L265 treat burnout_score_max: 3.5 as a maximum acceptable value and assess_dimension flags values above that threshold as issues. This creates an intent-level contradiction between the prose guidance and the code-backed monitoring logic for what the score means.
The document explicitly authorizes autonomous execution for actions above a confidence threshold, which creates a real security and safety risk because model confidence is not a reliable proxy for correctness or policy compliance. Even though execution is limited to an authorized scope, a miscalibrated model or adversarial input could still trigger harmful actions without human review.
| Confidence Level | Action | Rationale |
| :--- | :--- | :--- |
| **> 90%** | Auto-execute | High confidence; agent proceeds within its authorized scope. |
| **70% - 90%** | Human review | Moderate confidence; agent presents its analysis and recommendation to a human DRI for approval. |
| **< 70%** | Escalate / Reject | Low confidence; agent escalates to a senior DRI or rejects the task, requesting more information. |
This is a true security-relevant integrity issue. The documented thresholds include provenance_integrity and cynefin_classification_accuracy, but the assessment logic only checks metrics whose names contain min or max, so exact-match thresholds are silently ignored. That creates a false sense of coverage: operators may believe provenance and classification controls are enforced when they are not, allowing degraded governance or unsafe AI decision routing to go undetected.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| :--- | :--- | :--- |
| `score` | number (0.0 - 1.0) | The agent's confidence in its decision |
| `factors` | array of strings | Factors contributing to the confidence level |
| `routing_action` | enum | One of: "auto-executed", "human-reviewed", "escalated" |
## Outcome Object
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| :--- | :--- | :--- |
| `score` | number (0.0 - 1.0) | The agent's confidence in its decision |
| `factors` | array of strings | Factors contributing to the confidence level |
| `routing_action` | enum | One of: "auto-executed", "human-reviewed", "escalated" |
## Outcome Object
No suspicious patterns detected.