Security audit
Security checks for vulnerabilities and agentic risk
This is a prompt-only skill for organizing user-provided evidence into a timeline, with no code execution, network access, credentials, or persistence.
Installers should understand this skill helps structure facts and proof; it is not legal, financial, medical, or professional advice. Users should redact sensitive identifiers and share only the evidence needed for the timeline. The broad trigger wording may be worth narrowing in a future version, but it does not create a security hold by itself.
The file requires skill.json to declare 'language=en', which imposes a specific language setting. Under the policy, forcing a language without user opt-in or documented justification is a locale policy violation.
The acceptance criteria explicitly require 'Public-facing documentation is English only.' This is a natural-language locale restriction, and the file does not provide user choice or a clear region/compliance justification for forcing English.
The trigger keyword "explain what happened" is broad and can match many ordinary user requests unrelated to claims or evidence organization. This can cause the skill to activate outside its intended scope, leading to inappropriate prompt routing, confused outputs, or unintended handling of sensitive personal narratives in contexts where the specialized workflow was not requested.
Keywords such as "organize evidence," "incident timeline," "complaint timeline," and "supporting proof" are ambiguous without domain constraints and may overlap with legal, HR, medical, disciplinary, or other sensitive workflows. In a document-only skill, this ambiguity increases the chance of overbroad invocation and context drift, especially when users are discussing sensitive disputes and may receive structured outputs that appear more authoritative than intended.
The manifest sets the skill language to "en" with no indication that users may opt into another language or that English-only behavior is required for a documented regional or compliance reason. This can violate language/locale policy where skills should not force a specific language absent opt-in or justification.
