Security audit
Security checks for vulnerabilities and agentic risk
This Markdown-only skill is a coherent acceptance-testing guide, but users should run it only with test access and sanitized data.
Use this skill with staging or sandbox systems, least-privilege test accounts, and sanitized test data. Do not paste passwords, API keys, production secrets, or real customer data into the agent chat.
The trigger description and keywords are broad enough to match generic QA, verification, and regression-testing requests, which can cause this skill to activate outside a tightly scoped acceptance-testing context. That increases the chance the agent will solicit or process sensitive environment details, credentials, or test actions when a more limited or safer skill would have been appropriate.
The skill asks for system access methods, accounts, environment information, and optional test data, but does not warn users about handling sensitive credentials, production systems, or real-user data. In practice, this can normalize unsafe sharing of secrets and encourage testing against live environments with real data, creating confidentiality, integrity, and privacy risks.
