Security audit
Security checks for vulnerabilities and agentic risk
This creativity skill is transparent about learning creative preferences and does not include code, network access, credential use, or hidden execution.
Install this only if you are comfortable with the agent keeping local notes about your creative preferences and reactions. Review or clear preferences.md periodically if you do not want a long-term taste profile retained.
The skill description is broadly worded and lacks clear activation boundaries, which can cause the skill to engage in loosely related contexts instead of only when the user explicitly wants creative ideation. Overbroad triggering increases the chance of unintended data handling and unexpected behavior, especially because the skill also persists learned preferences.
The skill instructs checking and updating preferences.md after creative tasks, implying persistent storage of user taste and feedback without any user notice or consent flow. This creates a privacy risk because behavioral preferences and reactions may be recorded silently across sessions.
The learning workflow explicitly says to record user reactions in preferences.md, including approval, rejection, and choice patterns, without notifying the user that this feedback will persist. Silent retention of interaction history can expose sensitive preference profiles and violates user expectations around transparency and control.
The file explicitly instructs the system to 'update after every creative task' and to accumulate confirmed preferences, rejected directions, and an outcome log over time. This creates persistent behavioral profiling and history retention without any notice, consent, minimization, or guidance to avoid storing sensitive personal data that may emerge from user feedback, which can lead to unnecessary collection and retention of personal information.
