Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent bug-triage skill that uses a local case library and diagnostic examples, with no hidden execution, persistence, or exfiltration behavior found.
Install only if you want an English markdown-based troubleshooting workflow. When following its diagnostic examples, use non-production or low-risk requests where possible, avoid exposing real tokens unnecessarily, and confirm before letting the agent save new case notes.
The manifest-style header names the skill "bug-pattern-diagnosis-en," which indicates an English-only locale constraint. There is no accompanying language choice, opt-in, or justification that the skill is region- or language-specific, so this appears to violate the language/locale policy criteria.
The activation guidance includes a broad catch-all trigger for 'intersection / intermittent / non-deterministic' issues, which can cause the skill to activate for a wide range of unrelated bug reports. In an agent setting, over-broad routing is risky because it may steer users into this skill's case-library workflow unnecessarily, increasing the chance of irrelevant file access, noisy diagnosis, or misleading troubleshooting based on weak symptom similarity.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Fire 100 identical requests (replace URL, token, body)
for i in $(seq 1 100); do
curl -s -X POST "$URL" -H "Authorization: $TOKEN" -d "$BODY" \
| jq -r '.errorCode' | head -1
done | sort | uniq -c
No suspicious patterns detected.