Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent UK construction estimating skill with no executable code, persistence, credential use, or hidden data handling.
Install only if you want UK-focused construction estimates. Treat outputs as preliminary working estimates, verify current supplier prices and legal or tax requirements, and perform a site visit before relying on a quote commercially.
The description states the skill covers 'UK material prices and labour rates,' which hard-codes a locale-specific behavior. Because the skill is user-invocable and the manifest does not require confirming that the user wants UK assumptions, it may apply a specific regional locale without explicit user choice.
The document frames the skill around UK-specific trade rates, VAT, CIS guidance, and GBP pricing, and presents these defaults as the standard output behavior. This can violate language/locale policy expectations when users are not explicitly offered a choice of locale or informed that the skill is UK-only.
The manifest description and argument hint say to use the skill when someone needs to 'quote a job or estimate costs' from plain English, but they do not define explicit trigger phrases, exclusions, or a narrow invocation context. This creates ambiguity about when the skill should activate versus when a general budgeting or home-improvement conversation should remain with the base assistant.
No suspicious patterns detected.
