Security audit
Security checks for vulnerabilities and agentic risk
The skill clearly discloses cross-provider AI dispatch, but its claimed protection against file changes leaves shell commands unrestricted.
Review before installing. Use enforced read-only execution for questions and isolated, disposable workspaces for edits. Disabling named editing tools does not constrain shell commands. Share only task content and project information you authorize the selected provider to receive.
The skill instructs the agent to substitute task text into commands that dispatch it to other vendors. Although the external providers are identified, there is no warning that task content may include private user information, proprietary code, or secrets that will leave the current provider's boundary.
The configuration disables named file-editing tools but leaves shell execution available and explicitly instructs the orchestrator to use bash for dispatch. Shell commands can still modify or delete files, so the claim that the orchestrator cannot damage the working tree is false. This is particularly dangerous when processing untrusted task content or worker responses, because the supposed read-only boundary does not constrain shell-based actions.
