Security audit
Security checks for vulnerabilities and agentic risk
This is a plain Markdown debugging workflow skill with no bundled code, hidden execution, or persistence, though users should be careful when applying it to production diagnostics.
Install is reasonable for a debugging workflow. Before allowing production access or sharing HAR files, logs, dumps, or recordings, confirm what data will be captured, redact secrets and personal data, limit retention and access, and require cleanup of temporary probes after the issue is diagnosed.
The description says to use the skill when a user 'has tried 2+ things' or 'says diagnose,' which are broad conditions that can overlap with ordinary conversation about troubleshooting. The file does not provide explicit negative examples or tighter constraints to distinguish when this skill should not activate.
The skill explicitly suggests requesting permission to add temporary production instrumentation, but it does not warn about minimizing collection, avoiding secrets/PII, or controlling retention and access. In a debugging context, instrumentation often captures request payloads, headers, tokens, or user data, so omission of privacy and data-handling safeguards can lead to unintended exposure.
No suspicious patterns detected.
