Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward project-management skill that stores project notes in a local JSON file, with some caution needed around automatic record updates.
Install only if you want the assistant to maintain a local project record. Review or back up data/projects.json periodically, and ask the assistant to show proposed changes before saving if you do not want casual project comments recorded automatically.
The skill description is broad enough to match many ordinary productivity conversations, which can cause the skill to activate outside the user's intended context. Over-broad activation increases the chance the agent will read or act on persistent project data during unrelated chats, creating privacy and integrity risks through unnecessary invocation.
The instruction to update persistent JSON after any project conversation creates hidden state changes without explicit user awareness or consent. In practice, casual remarks could be converted into durable records, causing inaccurate project data, privacy issues, and unintended automation based on misunderstood conversation content.
No suspicious patterns detected.
