Security audit
Security checks for vulnerabilities and agentic risk
This Markdown-only interview-prep skill is purpose-aligned, but it automatically stores user-derived interview questions and weakness notes in persistent reference files without a clear confirmation or opt-out step.
Review before installing. This skill does not appear to run code, access credentials, or use the network, but it is designed to save interview-prep outputs and inferred weaknesses into local reference files automatically. Avoid using it with confidential employer/project details unless you are comfortable with those summaries being retained, and consider adding a confirmation or no-save step before use.
The skill description states that it automatically maintains reference documents, but does not warn the user that their submitted content may be written to persistent files. This creates a transparency and consent problem, especially when inputs may contain sensitive study notes, employer details, or project information.
The core file design persists learning themes and aggregated interview questions from user submissions without any minimization standard or sensitivity filter. In context, user learning notes and project summaries can easily include proprietary code details, workplace incidents, or personal weaknesses, so indiscriminate retention creates privacy and data-handling risk.
The workflow explicitly archives takeaways and weakness diagnoses into a long-term knowledge file. Storing inferred weaknesses is particularly sensitive because it creates a durable profile of the user's knowledge gaps, which may be embarrassing, privacy-sensitive, or harmful if later exposed or reused outside the user's expectations.
The skill is designed to activate on common phrases and then unconditionally update long-term documents, creating broad capture of user-submitted content. This combination makes the context more dangerous because ordinary educational interactions can silently become persistent logging workflows.
The trigger phrases are broad enough to match common study or interview-related requests, which can cause the skill to activate unexpectedly. Because the skill also performs persistent document updates, overbroad activation increases the chance of collecting and storing user content without clear intent or informed consent.
The instructions require automatic updates to both documents whenever trigger conditions are met, without an explicit warning or confirmation. This is dangerous because users may believe they are receiving transient assistance while the system is actually creating a durable record of their input-derived content.
No suspicious patterns detected.
