Security audit
Security checks for vulnerabilities and agentic risk
This is a prompt-only lost-wallet checklist skill that stays within official-channel planning and avoids credentials or automated actions.
Reasonable to install. When using it, keep using placeholders and do not share full card numbers, PINs, CVV codes, passwords, one-time codes, full SSNs, or unredacted ID images; verify contact paths through official apps, statements, agency sites, or in-person offices, and use emergency services or local authorities if there is immediate danger or home-security risk.
The file requires skill.json to declare language=en, which imposes a specific language setting. Because no opt-in or rationale is provided here, this appears to violate the policy against forcing a language or locale without user choice.
The acceptance criteria explicitly require public-facing documentation to be English only. This is a natural-language locale policy constraint, and the file does not present it as optional, user-selected, or justified by a region-specific purpose.
The language audit states that all public content is English, reinforcing an English-only requirement. This is a locale restriction stated as a blanket rule rather than a documented, justified exception or user-selectable option.
The manifest sets "language": "en", which imposes a specific language/locale choice. Under the policy, language restrictions should either be optional for the user or clearly justified as region-specific; no such opt-in or justification appears in this file.
