Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed project-management workflow that reads and updates one JSON task file, with clearly described optional reminder sync and chat notification side effects.
Install this only if the hardcoded projects.json path, Apple Reminders sync for sync:true tasks, and David chat notifications match your workflow. Avoid putting secrets or highly confidential details in task titles that may be synced or messaged.
The skill specifies that tasks may be synchronized to Apple Reminders when sync: true, which sends task content to an external application/service without any stated user consent, warning, or data-minimization controls. Project tasks can contain sensitive business information, so silent transmission outside the local JSON store creates a privacy and data-leak risk.
The skill instructs the agent to notify David in chat when tasks move to review or blocked, which shares internal project status with another party without any warning, authorization check, or scope restriction. Because task titles/statuses may reveal confidential roadmap, operational, or personnel information, this can leak sensitive data through chat channels.
