Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward text statistics tool that reads user-provided text files or stdin and does not show hidden, persistent, networked, or destructive behavior.
Install only if you are comfortable with the agent using this skill on text you explicitly provide or files you name. Avoid pointing it at sensitive files unless you intend their contents to be read for local analysis.
The skill advertises and demonstrates reading arbitrary files or stdin, but the manifest declares no explicit tool scope such as permissions or allowed-tools. That mismatch can cause the agent to invoke file-reading behavior without a clearly constrained authorization boundary, increasing the chance of unintended access to sensitive local files when the skill is selected.
The description uses broad routing language such as 'any text content,' which can cause the skill to be selected for a very wide range of prompts. In context, that overmatching is risky because the skill reads files/stdin, so ambiguous invocation could expose user content to a tool unnecessarily or trigger analysis of files beyond the user's intended target.
No suspicious patterns detected.
