Security audit
coordinator-evolution
Security checks for vulnerabilities and agentic risk
Overview
The skill's stated purpose (coordinator behavior) matches its instructions, but it also mandates that the agent internalize the policy as highest-priority behavior and unconditionally gather system snapshots (git status, file structure, tests), which grants broad access to local state without declaring or constraining that access — this discrepancy and the behavior-overriding language is concerning.
This skill is an instruction-only framework that tells the agent to act as a high-priority coordinator and to gather live snapshots of your system (git status, file tree, run tests) and to prefer precise, file-level edits. That behavior can expose code, configs, and secrets and can change the agent's global decision priority without asking. Before installing: verify the upstream repository and author, test the skill in an isolated/sandboxed agent with limited file access, and consider disabling autonomous invocation or requiring explicit user confirmation for file reads, code edits, and test execution. If you must use it in production, restrict its filesystem and Git access, monitor all actions and change commits, and only grant the minimum permissions required per task.
SkillSpector findings are pending for this release.