Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only CISO guidance skill whose security operations advice is broad but coherent with its stated purpose and not backed by hidden code or persistence.
Install only if you want broad security-program and incident-response guidance. Do not paste live secrets into chat, and require explicit human approval before any real-world destructive or high-impact action such as disabling accounts, rotating production credentials, taking systems offline, wiping hosts, notifying customers, or accepting third-party risk.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Vendor Termination Checklist
- [ ] Data return/deletion confirmed in writing
- [ ] Access credentials revoked
- [ ] SSO/OAuth integrations removed
- [ ] DNS/network connections removed
- [ ] API keys rotated
The 'When to Use' section says the skill applies when a user needs 'CISO-level guidance for information security' and describes the agent as handling broad security operations, compliance, risk management, and incident response. This is an expansive, ambiguous activation scope without explicit trigger phrases, exclusions, or negative examples, which could cause unintended invocation for many generic security-related requests.
This markdown file provides broad incident response procedures but does not define specific trigger phrases, invocation boundaries, or exclusion conditions. In a skill context, such generic security content could be matched too broadly unless the activation scope is constrained elsewhere.
No suspicious patterns detected.