Security audit
Security checks for vulnerabilities and agentic risk
This home-buying skill is a disclosed local workflow helper; it stores scoped notes locally and does not show hidden automation, external sharing, or transaction authority.
Before installing, decide whether you want persistent local home-buying memory at ~/home-buying/. Use explicit activation or one-transaction mode if you do not want this skill shaping every home-buying discussion, and avoid storing full identity documents, account numbers, or lender portal credentials.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
integration: pending
## Buy Box
<!-- Non-negotiables: location, property type, size, timeline -->
<!-- Deal-breakers and acceptable compromises -->
## Budget Guardrails
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
## Budget Guardrails
<!-- Monthly all-in ceiling and preferred range -->
<!-- Cash to close range and reserve target -->
## Financing Context
<!-- Pre-approval status, rate assumptions, lender constraints -->
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Cash-to-close changed materially without explanation
- New title exception with unresolved risk
- Insurance premium shock that breaks affordability
- Repairs marked complete without verification
## Final Gate Decision
The activation criteria are broad enough to trigger on general discussion of home buying, mortgages, or closing, which can cause the skill to engage and shape advice without clear user intent. In a domain involving major financial decisions and context collection, over-activation increases the risk of unwanted profiling, unnecessary persistence of sensitive preferences, and misleading automation in ordinary conversation.
The skill directs the agent to persist home-buying context to a local memory file, but it does not require a clear user-facing notice and consent flow before storing potentially sensitive financial and housing preference data. Even though it says not to save secrets or unnecessary identifiers, the retained information can still reveal budget, geography, financing posture, and risk tolerance, creating privacy and confidentiality concerns.
No suspicious patterns detected.