Security audit
Security checks for vulnerabilities and agentic risk
This is an advisory-only documentation skill for choosing agent frameworks; it contains examples that users should review carefully but no executable payload or hidden behavior.
Install only if you want advisory help with agent frameworks and MCP-style tool selection. Treat its command blocks as examples to review and pin yourself, and keep any real service tokens narrow, short-lived, and behind human approval for write actions.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Write-action note: create_issue below is a mutating call. In production it
should be gated by a human confirmation step and a narrow token (single repo,
issues:write only), not an org-wide personal access token.
### Example 3: Cost blow-up in a multi-agent crew
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Refuse-and-replace rule: if a skill asks for broader permissions than the task requires, look for a narrower alternative rather than granting them.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The example npx mcp install @modelcontextprotocol/server-postgres@<PINNED_VERSION> pins the server package but not the mcp CLI itself. Running an unpinned CLI via npx can fetch a changing tool version at execution time, creating a supply-chain and reproducibility risk.
As with the prior line, npx mcp install @modelcontextprotocol/server-slack@<PINNED_VERSION> leaves the mcp CLI unpinned even though the server package is pinned. That allows a different CLI version to be downloaded and executed later, undermining the skill's stated version-pinning policy.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
skill is advisory-only, listing explicit out-of-scope topics (SQP-1) and
covering version pinning, credential scope, write-action confirmation and data
minimisation (SQP-2, RP1, T08). Pinned every npm/npx invocation to an explicit
version placeholder. Replaced the "can never loop forever" claim with a precise
statement about configured retry caps plus wall-clock timeouts (EA4). Added a
credential-scope row to the comparison matrix and a "Guardrail to add first"
column to the scenario table. Added a third worked example for all six
The trigger phrase "find tools for my agent" is generic enough that it could match many ordinary agent-building conversations, not just this skill's specific scope. Although the document narrows scope elsewhere, this individual trigger lacks constraints or a negative example to prevent unintended invocation.
This example demonstrates a write action that creates a remote resource, which can affect external systems. While the document contains general safety guidance elsewhere and a later warning in Example 2, the specific code example itself appears before any local warning, so a reader could copy it without noticing the need for confirmation gating.
No suspicious patterns detected.