Security audit
Security checks for vulnerabilities and agentic risk
This is a simple brand-voice writing skill whose local profile storage and style analysis are aligned with its stated purpose, with some privacy considerations users should understand.
Before installing, understand that this skill is meant to save a reusable brand voice profile locally. Do not provide private drafts, client content, or unpublished material for analysis unless you want those style details reflected in future outputs; review or delete brand-voice/profile.json if you no longer want it retained.
The skill directs the agent to create and update brand-voice/profile.json without explicitly warning the user that this causes persistent local file writes. This can lead to unintended retention of sensitive brand, audience, or writing-preference data and surprises users who expected a transient conversation rather than storage.
The skill instructs the agent to read a user's last 10 posts or articles to infer style, but it does not warn that those materials may contain sensitive or private information. If used on local drafts, unpublished articles, or mixed-content directories, the agent could ingest more data than the user intended and persist or reuse it in later outputs.
The description says to use the skill for broad situations like generating content that matches your voice, onboarding a new content workflow, or ensuring consistency across platforms. These are general writing scenarios and the file does not define specific trigger phrases, scope limits, or negative examples, which could cause unintended invocation in ordinary content tasks.
No suspicious patterns detected.
