Security audit
Security checks for vulnerabilities and agentic risk
This is a simple acoustic guitar coaching and practice-log skill, with the main caveat that it may create a local practice folder and store progress notes there.
Before installing, be aware that the skill is designed to keep local guitar practice notes under ~/acoustic-guitar/. Use it if you are comfortable with local progress tracking, and ask the agent not to create or update logs unless you explicitly request it if you prefer advice-only use.
The trigger list includes generic conditions like 'They mention practicing or learning songs' and 'They struggle with something specific,' which overlap with normal music-related discussion and do not clearly define when the skill should or should not activate. The section also lacks limiting context or negative examples to prevent accidental invocation.
The skill instructs the agent to create ~/acoustic-guitar/ on first interaction without explicitly informing the user or obtaining consent. Even though the action appears harmless and aligned with the skill’s purpose, silent filesystem modification violates least surprise and can create privacy, clutter, or policy concerns in environments where file writes require user approval.
No suspicious patterns detected.
