Security audit
Security checks for vulnerabilities and agentic risk
This is a principles-only engineering guidance skill with broad activation language, but it does not include scripts, network access, credential handling, persistence mechanisms, or hidden behavior.
Install this if you want the agent to consistently apply architecture and engineering-quality review habits during coding tasks. Be aware that it is broad and may influence many code changes or reviews, so users who want narrow, task-specific behavior may prefer to invoke it only when architecture guidance is desired.
The README says to invoke the skill when you need to 'Make changes to a codebase,' 'Design a new feature,' or 'Perform a code review,' which are very broad activities that overlap with many routine requests. It does not provide constraints, narrower trigger phrases, or negative examples to clarify when the skill should and should not activate.
The skill's invocation guidance is extremely broad: it says to use this skill whenever making code changes, designing features, or doing reviews, which covers a large fraction of engineering interactions. That can cause persistent instruction overreach, where the skill influences tasks beyond a narrowly scoped purpose and increases the chance of unnecessary policy shaping, workflow interference, or accidental precedence over more task-specific guidance.
The README says the skill is invoked automatically when the user makes changes to a codebase, designs a new feature, or performs a code review. These are broad, common activities without scope limits, exclusions, or negative examples, so the trigger conditions are ambiguous and likely to overlap with many ordinary interactions.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- inconsistent patterns
- technical debt introduced by the change
- violations of project conventions
Surface meaningful issues even when they are outside the immediate task, but do not expand scope unnecessarily.
## 9. Separate Facts From Preferences
Do not label something as an architectural problem merely because it is different from your preferred style.
No suspicious patterns detected.