ChangeBrief
Security checks across malware telemetry and agentic risk
Overview
ChangeBrief's code, docs, and runtime instructions are coherent with its stated purpose: it compares two snapshots and surfaces deltas, and it does not request unrelated credentials or perform obvious network/exfiltration actions in the provided materials.
This skill appears internally consistent and focused: it analyzes two snapshots provided as files or inline text and returns change-focused output. Before installing or invoking: (1) review the full src/index.js locally and run the included tests (node test/test.js) to confirm behavior; (2) only pass files that do not contain secrets or sensitive credentials, since the skill will read any files you give it; (3) note that the skill runs locally and does not declare network calls or external credentials in the provided files — still verify there are no hidden network calls in the full source before trusting it with highly sensitive data; (4) keep autonomous invocation disabled at the agent level if you prefer manual control (the skill being able to be invoked autonomously is normal but increases blast radius).
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings