Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed local home-renovation planner that stores project notes, budgets, timelines, and contractor details in a dedicated folder.
Before installing, understand that this skill is meant to keep renovation records across sessions, including budgets and contractor contact details, in ~/home-renovation/. Choose the on-request or declined integration preference if you do not want it to engage whenever renovation topics come up.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
integration: pending
## Active Projects
<!-- List current renovation projects -->
<!-- Example: Kitchen remodel - started Jan 2026, budget $40K -->
## Context
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- Example: Kitchen remodel - started Jan 2026, budget $40K -->
## Context
<!-- What you've learned about their situation -->
<!-- Their home type, location (for cost context), experience level -->
## Notes
The integration setting 'always' paired with 'Activate whenever renovation mentioned' creates an overly broad trigger that can cause the skill to engage and retain context from ordinary conversation without a clear, specific user request. In a memory-enabled skill, this can lead to unintended activation, unnecessary profiling of user interests, and collection of project details the user did not expect to be tracked.
The instruction to read this setup when the directory doesn't exist or is empty, combined with 'Start the conversation naturally' and later guidance to engage early, creates an ambiguous activation boundary. This can cause the skill to begin participating without a clear user request, increasing the chance of unintended behavior, surprise persistence, or inappropriate context switching.
The skill instructs the agent to save project details, preferences, contractor information, and budgets to local files under ~/home-renovation/ without requiring a clear user-facing disclosure or consent flow. Persistent storage of potentially sensitive household and financial information without notice can violate user expectations and expose private data to other local processes, users, or future sessions.
No suspicious patterns detected.