Security audit
Security checks for vulnerabilities and agentic risk
This is a strategy-advice skill with disclosed lightweight local memory, and I found no hidden payload, credential access, network activity, or destructive behavior.
Before installing, be aware that the skill may create and reuse local notes under ~/strategy to remember strategy context. Avoid placing secrets or highly sensitive business details there unless you are comfortable storing them in local markdown files.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# Strategy Memory
## Context
<!-- Your role, industry, company stage -->
Role:
Industry:
Company stage:
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
-
## Strategic Preferences
<!-- How you like to work -->
Risk tolerance: [conservative/moderate/aggressive]
Planning horizon: [weeks/months/years]
Decision style: [data-driven/intuition/consensus]
The description says the skill can "Design robust strategies for any domain," which is extremely broad and lacks clear trigger boundaries or exclusions. In a manifest/markdown context, this can overlap with many ordinary planning or advice-seeking requests, increasing the risk of unintended invocation.
The skill explicitly instructs creation of directories and files under the user's home directory (~/strategy/...) without any warning, consent flow, or indication that local filesystem state will be modified. While the actions are limited and not inherently malicious, silent persistence in a user's home directory can create unexpected side effects, privacy concerns, or trust issues in agent-driven environments.
No suspicious patterns detected.