Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward business document template generator, with local saving guidance that users should handle carefully.
Before installing, be aware that the skill may help draft documents containing client names, addresses, prices, payment terms, and legal language; confirm important figures and legal terms yourself, and only save generated documents in the workspace when you are comfortable retaining that information locally.
The trigger list is broad enough to activate on common requests like general document writing or drafting help, which can cause the skill to engage unexpectedly. Overbroad activation can lead to unintended application of this skill's instructions, including persistence behavior and legal-document defaults, in contexts where the user did not request this specialized workflow.
The activation logic includes an open-ended catch-all ('Any combination of the above with customization needs'), which lacks clear boundaries and makes over-activation more likely. In context, this is more dangerous because the skill also collects structured business data and instructs storage in the workspace, so accidental invocation may expose or retain more sensitive information than necessary.
The skill directs storage of generated templates in the user workspace without a clear warning that content may persist locally. Because the documents may contain client identities, addresses, pricing, payment instructions, and contract terms, undisclosed persistence creates privacy and confidentiality risks.
The skill includes an instruction to store generated document templates in the user workspace even though its primary function is content generation, not persistence. This creates an unnecessary data-retention behavior that may save sensitive business, financial, or legal information without explicit user consent or clear disclosure.
