Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent build automation, but it can make persistent code changes, install repository hooks, commit automatically, and continue across phases from broad trigger phrases.
Install only if you want an agent to autonomously execute existing plan tasks, run local build/test/lint commands, modify files, install repo hooks, and create git commits. Prefer invoking it explicitly with a track or task, and review the repository state before and after runs.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Then update plan.md: all tasks in that phase `[x]` → `[ ]`.
**Never use `git reset --hard`** — always `git revert` to preserve history.
## Progress Tracking (TodoWrite)
The trigger phrases are overly broad and map common conversational language like 'build it' and 'ship it' to a high-impact autonomous execution skill. In context, this skill can edit files, run shell commands, install hooks, and commit to git, so accidental activation could cause unintended code changes or command execution without sufficiently explicit user intent.
Line L016 says the skill is 'self-contained' and should follow its own loop instead of delegating to external skills, but the skill explicitly authorizes and recommends external MCP tools such as web search and Context7 docs lookup at L010 and L026-L032. That is an active contradiction in the documented operating model, not just an omitted detail.
The skill authorizes itself to proceed through phases automatically with 'No approval needed' after making code changes, running commands, and creating commits. In an execution skill with Bash, Write, Edit, and git capabilities, reducing human checkpoints increases the chance of unintended or unsafe changes being applied broadly before a user can intervene.
Revert this phase: git revert abc1234..HEAD
Proceed to the next phase automatically. No approval needed.
## Error Handling
L039 states 'only docs/plan/' and 'DO NOT search for conductor/ or any other directory,' but the immediately following startup steps instruct loading docs/workflow.md, stack YAML, CLAUDE.md, and .solo pipeline state from other paths at L041-L050 and L095-L100. This creates contradictory operator guidance about what directories may be accessed during initial setup.
No suspicious patterns detected.