Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent strategic-decision advisor with no evidence of hidden data access, persistence, remote execution, or credential handling.
Install only if you want a decision-analysis framework that may activate on broad option-comparison or risk-assessment requests. Treat its recommendations as advisory, especially for legal, financial, compliance, or high-impact decisions, and review any generated HTML output path before running the optional script.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# ============================================
# Environment and configuration (keep templates)
# ============================================
.env
.env.local
.env.*.local
!.env.example
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Environment and configuration (keep templates)
# ============================================
.env
.env.local
.env.*.local
!.env.example
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
2. Add evaluation dimensions in references/decision-matrix.md
3. Update the weight system in magi-framework.md
4. Update method-patterns.md schemas in section 1.2
5. Update SKILL.md capability index and file routing map
### 4.2 Adding a New Risk Domain
The file contains explicit natural-language policy constraints requiring that comments/docstrings and all markdown content be in English. Under the policy, forcing a specific language without user choice or a clearly documented, justified locale requirement is a violation.
Lines L024-L026 require all compiled skill content, reference content, scripts, and prompt content to be written in English. This is a natural-language policy constraint that forces a specific language across the skill without offering user choice or documenting a region-specific justification.
The phrase "The project enforces language" indicates a mandatory language policy, but this README does not specify user opt-in, available alternatives, or a justified region-specific need. Under the policy rules, forcing a language or locale without opt-in is a natural-language policy violation.
The trigger conditions are broad and overlap with common user requests such as asking for risk assessment, comparing options, or making major decisions. This can cause the skill to activate unintentionally in contexts where the user did not explicitly request this framework, leading to overreach, confusing behavior, or inappropriate loading of additional references and scripts.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
No suspicious patterns detected.