Security audit
Security checks for vulnerabilities and agentic risk
This is a document-only home water leak logging skill with clear safety limits and no code, network, credentials, or persistence behavior.
Installers should understand this skill is for organizing and documenting the first hour of a home water leak, not for repairing plumbing or electrical problems. It should be safe to use as a prompt-only checklist, but users should still call emergency help or qualified professionals for flooding, electrical hazards, structural danger, sewage, or unsafe conditions.
The checklist explicitly states 'Language is English only,' which is a natural-language locale restriction. The file does not indicate user choice, opt-in, or a clear justification for limiting the skill to English, so this appears to violate the language/locale policy.
This markdown file describes the skill's input and workflow in general terms, but it does not specify precise invocation phrases, scope boundaries, or negative examples for when the skill should not activate. Phrases like 'User provides leak discovery details' could apply to a wide range of ordinary conversation about household leaks, increasing the chance of unintended invocation.
The manifest sets language: "en", which is a natural-language locale constraint. The file does not indicate that the user can opt into another language or that the English-only setting is required for a documented region-specific purpose.
The manifest sets the skill language to "en", which is a natural-language locale constraint. Under the policy rule, locale restrictions should either offer user opt-in or be clearly justified as region- or compliance-specific; this file does neither.
