Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Andorra travel-planning skill with local preference notes and no executable, network, credential, or hidden behavior found.
Install if you want Andorra-specific travel planning. Before allowing memory, decide whether you want trip style, budget, transport, and travel history kept in ~/andorra/ for future recommendations.
The instruction "Read this when ~/andorra/ doesn't exist or is empty. Start naturally." does not define a specific user-facing trigger phrase or clear exclusion conditions for when this skill should or should not activate. "Start naturally" is especially vague and could lead to unintended invocation because it provides no narrow scope or negative examples.
The skill explicitly tells the agent to save user travel preferences to memory after asking, 'Want me to keep your Andorra preferences handy for future trip ideas?', but it does not clearly disclose retention scope, duration, or what 'main memory' means. This creates a privacy risk because users may consent without understanding that their preferences could persist beyond the current session and influence future interactions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Mistakes to Avoid
- Booking the cheapest room without checking the daily transfer cost in time
- Forgetting that parking can be the hidden tax of a city stay
- Assuming a late-night winter drive is easy just because the distance is short
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Mistakes to Avoid
- Booking the cheapest room without checking the daily transfer cost in time
- Forgetting that parking can be the hidden tax of a city stay
- Assuming a late-night winter drive is easy just because the distance is short
Line L03 says that 'showing basic awareness of the country's own identity helps' immediately after emphasizing Andorra as 'Catalan first,' which can be read as prescribing a specific linguistic or cultural framing for users. Because SQP-3 covers language or locale policy violations, this is a mild concern where the guidance nudges toward one locale identity without explicit user opt-in or a stated choice.
This markdown file appears to describe when the skill should guide users toward certain dining choices, but it does not define any explicit trigger phrases, invocation conditions, or negative examples. That makes activation scope ambiguous and could cause the skill to match broad travel or food-related requests unintentionally.
No suspicious patterns detected.