Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed productivity helper for noticing coding scope drift and does not include hidden code, network access, or automatic privileged behavior.
Before installing, expect the agent to watch local coding activity for scope drift and possibly suggest stashing or committing unrelated work separately. Treat those as prompts to review, not actions to approve automatically, especially in repositories with sensitive or unfinished changes.
The 'When to Invoke' section says to use the skill 'At the start of every focused task,' which is a very broad activation condition rather than a narrowly scoped trigger. Because it lacks explicit boundaries or negative examples, it could overlap with many ordinary work situations and cause unintended or excessive invocation.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
│ ├── Offer choices:
│ │ ├── STASH: Save off-scope changes for a separate task
│ │ ├── COMMIT SEPARATELY: Make a separate commit for the off-scope work
│ │ ├── EXPAND SCOPE: Acknowledge the scope grew (with justification)
│ │ └── CONTINUE: You're aware and choosing to continue
│ └── Log the decision for later review
└── Resume monitoring with updated scope (if expanded)
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
│ ├── Offer choices:
│ │ ├── STASH: Save off-scope changes for a separate task
│ │ ├── COMMIT SEPARATELY: Make a separate commit for the off-scope work
│ │ ├── EXPAND SCOPE: Acknowledge the scope grew (with justification)
│ │ └── CONTINUE: You're aware and choosing to continue
│ └── Log the decision for later review
└── Resume monitoring with updated scope (if expanded)
No suspicious patterns detected.