Security audit
Security checks for vulnerabilities and agentic risk
This is a prompt-only decision-planning skill that produces a risk register and does not request code execution, network access, credentials, persistence, or privileged actions.
Install this as a lightweight planning aid, not as professional advice. For decisions with serious legal, medical, financial, employment, safety, or irreversible consequences, use it only to organize questions and risks before consulting a qualified expert.
The trigger example is broad enough to match ordinary decision-support requests, which can cause the skill to activate in situations beyond its intended scope. While this file contains no code execution or external actions, overbroad activation can still lead to inappropriate use in higher-stakes contexts without sufficient boundaries or escalation guidance.
The install-first path uses very generic language like asking about the risks of a decision, which overlaps with many everyday prompts and increases the chance of unintended auto-invocation. In a prompt-only skill, this is primarily a scope and safety-boundary problem, but it becomes more dangerous because the skill concerns real-world decisions and may be applied to consequential situations without adequate qualification.
The trigger phrases include broad natural-language requests such as 'What could go wrong if I do this' and 'How do I mitigate this plan,' which can match many ordinary conversations and cause the skill to activate unintentionally. Unintended invocation can steer users into a structured risk-assessment workflow when they did not ask for it, creating prompt-routing confusion and potentially pulling sensitive decision context into the skill unnecessarily.
This manifest file defines activation phrases such as "help me make a risk register," "what could go wrong if I do this," and "mitigate this plan," which are broad natural-language requests that could match ordinary conversation outside a narrowly scoped skill invocation. The manifest does not provide exclusion conditions or tighter trigger constraints to reduce unintended activation.
The manifest sets language: en, which indicates an English-only constraint, but the document does not offer opt-in language choice or explain why the skill must be limited to English. Under the policy, forcing a specific language without user opt-in can be a locale policy violation.
The file specifies "language": "en", which imposes a fixed language setting in natural-language metadata. There is no indication of user opt-in, multilingual support, or documented reason for restricting the skill to English.
No suspicious patterns detected.
