Security audit
Security checks for vulnerabilities and agentic risk
This skill runs a local code-metrics script that reads source files in a chosen project and reports counts and complexity, with no evidence of hidden persistence, credential access, network use, or destructive behavior.
Installers should understand that this skill reads source files under the project path being analyzed. Use it on repositories you intend to inspect, and avoid pointing it at broad home or system directories if you do not want those source files included in metrics output.
The skill advertises codebase analysis behavior that inherently requires reading project files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch can lead to overbroad file access at runtime or unclear enforcement boundaries, increasing the chance the agent reads unintended files in the workspace.
The description contains broad invocation phrases like 'analyze code quality' and 'get a project overview,' which can cause the skill to trigger in loosely related contexts. Overly broad routing increases the likelihood of unnecessary file inspection or accidental activation when a user did not specifically request repository-wide analysis.
No suspicious patterns detected.
