Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only FinOps guidance skill; it is broadly scoped and mentions cleanup automation, but it does not contain executable code or hidden access behavior.
Installers should treat this as FinOps reference guidance, not an automation runbook. Use read-only billing access where possible, limit any cloud permissions to the task, and require human approval plus owner, backup, and change-window checks before deleting or terminating resources.
The manifest description says to use the skill for "any cloud financial operations questions," alongside a very wide list of related topics. This broad phrasing lacks clear activation boundaries or exclusion conditions, increasing the chance of unintended invocation for general cloud, budgeting, governance, or sustainability discussions that may not specifically require this skill.
The governance examples include 'idle resource cleanup' with auto-termination after X days, but the skill does not pair this with validation, exclusions, backup checks, or explicit confirmation requirements. In a FinOps context, users may operationalize such guidance directly, creating risk of accidental deletion of still-needed resources and resulting service disruption or data loss.
The example scenario recommends identifying and deleting 'obvious waste' such as unattached volumes and unused IPs without warning that these resources may still be needed for recovery, pending deployments, or misconfigured attachments. Because this is presented as a quick win in an operational guidance skill, it could encourage users to take destructive action without sufficient verification.
No suspicious patterns detected.
