Security audit
Security checks for vulnerabilities and agentic risk
This skill is a plain Markdown planning helper that appends researched task lists to project backlog files, with no hidden code or install-time behavior found.
Install this if you want an agent to maintain backlog-style planning files from feature discussions. Use explicit wording when you want persistent backlog edits, and review appended tasks before running goal-runner or any unattended executor against them.
The skill advertises activation on very broad natural-language phrases like 'add this to the backlog' or 'plan these tasks', which can appear in ordinary project discussion. That creates a prompt-routing risk where the agent may invoke this skill unintentionally, causing unsolicited file modifications to roadmap/backlog documents and potentially steering workflow without explicit user intent.
The repeated 'when to use' trigger phrases reinforce ambiguous everyday-language activation without enough disambiguation from adjacent intents like discussion, design, or execution. In an agentic environment, this increases the chance of incorrect tool/skill selection and unintended append-only changes to project planning artifacts, which can poison downstream automation such as goal-runner.
No suspicious patterns detected.
