Security audit
Security checks for vulnerabilities and agentic risk
This skill fits PC-build planning, though its integrated-graphics assumptions and BIOS-update advice need independent checking.
Verify CPU graphics support before buying a build without a separate graphics card, and recheck current prices. BIOS advice is incomplete: confirm the exact motherboard model and revision, use manufacturer firmware and instructions, and maintain uninterrupted power; a failed update can prevent startup. Catalog exports can replace the explicitly chosen output file.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow explicitly recommends updating BIOS on a newly assembled computer, but does not warn that an interrupted update or incompatible firmware can leave the motherboard unable to boot. References elsewhere to BIOS compatibility and stable versions do not disclose the risks of the update itself.
When explicit graphics data is absent, any item matching broad Intel-related text is assigned integrated graphics unless an F/KF suffix is detected, even if its model is unknown or lacks integrated graphics for another reason. Because this skill uses inferred specifications for compatibility checks and no-discrete-GPU recommendations, malformed or misleading catalog entries can produce builds without working display output, causing unnecessary purchases and rework. This is a recommendation-integrity flaw rather than evidence of code execution or data theft.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
def query(category=None, budget=None, platform=None, color=None,
rgb=None, limit=DEFAULT_QUERY_LIMIT, has_price_only=True, showcase=None,
include_legacy=False, sort="asc", socket=None, chipset=None,
memory_gen=None, form_factor=None, max_length=None, max_cooler_height=None,
gpu_cooling="air",
gpu_chip=None, min_vram=None, min_capacity=None, include_workstation_gpu=False,
resolution=None, min_refresh=None, air_flow=None, dust_filter=None,
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
def query_all(budget=None, platform=None, color=None, rgb=None, limit=5,
has_price_only=True, include_legacy=False, sort="asc", socket=None,
chipset=None, memory_gen=None, form_factor=None, max_length=None,
gpu_cooling="air", gpu_chip=None, min_vram=None, min_capacity=None,
include_workstation_gpu=False, showcase=None, air_flow=None, dust_filter=None,
model=None, item_id=None, max_capacity=None, integrated_graphics=None,
The manifest explicitly says not to use this skill for laptops. L062 nevertheless instructs the assistant to recommend manufacturer performance modes and check power and cooling settings for laptops, extending its guidance beyond the declared desktop-only scope.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"budget", "max_length", "max_cooler_height", "min_vram", "min_capacity", "max_capacity",
"fan_size", "radiator_bundle", "min_refresh", "min_pcie_slots", "limit",
):
value = getattr(args, name)
if value is not None and value <= 0:
parser.error(f"--{name.replace('_', '-')} must be greater than 0")
if (
No suspicious patterns detected.