Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Effector ecosystem guidance package, with minor documentation cautions around geolocation, locale examples, and broad audit wording.
Safe to install for Effector-related work. When using generated examples, confirm before adding geolocation, adapt locale values to the project audience, and keep the documented storage guidance: do not put secrets in browser storage and validate persisted data.
The markdown lists geolocation as a useful browser signal, but does not include any caution that location access is privacy-sensitive or may trigger browser permission prompts. For markdown files, safety-relevant behaviors affecting user privacy should be disclosed explicitly.
This markdown file says to use the playbook when the user asks for a “full audit”, “best practices audit”, or similar review requests, but it does not define exclusions or a tighter scope. Those phrases are broad and common in normal review workflows, which could cause the skill to be invoked in situations beyond the intended Effector-specific production audit context.
The example sets <html lang="en">, which is natural-language locale policy embedded in the skill content. The file does not indicate that English is optional, user-selected, or required for a region-specific use case, so it can be read as forcing a specific language setting by default.
The i18n section directs implementers to store and react to language values, but does not mention offering users a language choice or obtaining locale preference from the user. Because policy violations include forcing a specific language without user opt-in, this omission can create a risk of non-compliant implementations.
