Security audit
Security checks for vulnerabilities and agentic risk
This skill is a codebase research helper that reads project files, launches researcher subagents, and writes a local research report; its main risks are disclosed and purpose-aligned.
Install only if you want an agent to inspect your codebase and create or update a local research.md file. Before sharing that report, review repository metadata and file references for private project details, and avoid running it in a directory where an existing research.md must be preserved unless you have a backup.
The skill mandates creating or overwriting research.md in the current working directory regardless of user intent, which is a side effect on the filesystem without an explicit consent or warning step. In an orchestration skill, this can unexpectedly modify a repository, dirty a working tree, or overwrite an existing file, especially when run in sensitive or automated environments.
The skill instructs gathering the repository remote URL and embedding repository metadata into the generated output without warning the user that this information may be exposed. Remote URLs can contain sensitive internal hostnames, organization names, repository paths, or even embedded credentials/tokens in misconfigured environments, so surfacing them increases disclosure risk.
No suspicious patterns detected.
