Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it advertises: it turns a PRD GitHub issue into reviewed implementation issues, with no hidden scripts or persistence.
Before installing, be aware that using this skill can read GitHub issue contents and create new GitHub issues. Confirm the repository, PRD issue, and drafted issue text before letting the agent run the create step, especially for private or sensitive projects.
The skill directs the agent to create GitHub issues with gh issue create, which performs a write action against an external system, but it provides no explicit warning or confirmation step. Without clear disclosure and approval, the agent could create unwanted tickets, leak sensitive PRD details into GitHub, or modify project workflow in a way the user did not intend.
The skill instructs the agent to fetch a GitHub issue with gh issue view, which triggers an external API/network action, but it does not tell the user that repository data may be accessed or transmitted outside the current conversation context. This weakens informed consent and can surprise users in sensitive or private repositories, though the action is read-only and lower risk than write operations.
