Security audit
Security checks for vulnerabilities and agentic risk
This is a small local link-creation skill with no evidence of hidden persistence, credential access, network activity, or exfiltration, though its documentation overstates what the bundled script does.
Install only if you are comfortable with a skill that can create local filesystem links. Review paths before use, avoid force replacement in sensitive directories, and note that the bundled script currently supports only symbolic links despite the broader documentation.
The declared description says the skill creates both hard and symbolic links, but the provided code only creates symbolic links via os.symlink and has no logic for hard link creation (such as os.link). Its primary purpose is still link creation, so the mismatch is limited but material because part of the declared functionality is not actually present.
Documenting force-replacement behavior without an explicit warning normalizes a destructive operation that can remove an existing destination path. In a file-manipulation skill, this increases the chance that an agent or user overwrites important files or links unintentionally, especially when operating on attacker-influenced paths or in sensitive directories.
