Security audit
Security checks for vulnerabilities and agentic risk
The skill is not destructive or data-seeking, but it broadly and silently changes agent behavior across a session without clear user control.
Review before installing. This skill does not appear to steal data, run code, or persist on the system, but it is designed to affect every message and silently change reasoning behavior. Install only if you want that session-wide automation and visible reasoning markers, and prefer a version that requires explicit opt-in for reasoning changes.
Applying the skill to every user message is overly broad and forces persistent interception of all interactions, including trivial or sensitive ones. In a preprocessing skill, this increases the chance of policy drift, unnecessary state changes, and unintended behavior across the entire session.
The automatic activation section directs the agent to enable reasoning silently and without clear scope boundaries. Ambiguous autonomous state changes can override user preferences, conflict with host policies, and make agent behavior less predictable and auditable.
The skill mandates visible reasoning-mode indicators and behavior changes without user opt-in. This can expose internal operating modes, create confusing output artifacts, and pressure the agent to follow skill-specific formatting rather than system or user requirements.
The skill says no external tools are needed, yet elsewhere instructs use of a tool or command to change reasoning state. This inconsistency can mislead operators about the skill's capabilities and encourage unauthorized tool invocation or unsupported control-channel behavior.
The skill is described as a mental preprocessing aid, but it also instructs the agent to alter visible output by appending reasoning icons. This creates hidden policy-to-output coupling that can leak internal state or cause responses to deviate from platform norms without user consent.
No suspicious patterns detected.
