Security audit
Security checks for vulnerabilities and agentic risk
This skill is a planning and delegation guide that creates local planning/log files but does not contain executable code, credential access, exfiltration, or hidden persistence.
Install only if you want an agent to turn larger goals into local delegation plans and evaluation steps. Review the generated DELEGATION_PLAN.md before execution, avoid including secrets in task descriptions, and periodically delete or audit .learnings/LEARNINGS.md if the workspace contains sensitive project history.
The invocation description is extremely broad and can activate on vague requests like 'starting anything new' or 'break this down,' causing the agent to enter a decomposition-and-delegation workflow without clear user intent or scope. In practice, that increases the chance of over-collection, unnecessary file creation, and premature task spawning based on underspecified prompts.
The document states in L169-L175 that during execution Opus's only role is to monitor and reroute, and explicitly says Opus does not write code, generate content, run builds, or do research queries. But earlier and later instructions direct the skill to write workspace/DELEGATION_PLAN.md (L167) and append to .learnings/LEARNINGS.md (L187), which are content-producing side effects beyond the stated 'only role' framing.
The skill instructs writing a full plan to workspace/DELEGATION_PLAN.md but does not warn the user in the skill description that persistent workspace artifacts will be created. This can surprise users, leak sensitive project details into shared storage, or violate expectations in environments where file writes should be explicit and consented to.
Appending timing and pass/fail data to .learnings/LEARNINGS.md creates persistent logging without any user warning, retention policy, or sensitivity filtering. Over time this can accumulate operational metadata, task history, filenames, and potentially sensitive context that may be exposed to later runs, other tools, or other users of the workspace.
