Security audit
Security checks for vulnerabilities and agentic risk
This file-compare skill is very small, but it asks for an unexplained API key and gives broad filesystem-use guidance without enough scoping or data-flow disclosure.
Review before installing. Only use this for explicitly requested file comparisons, avoid sensitive files unless the publisher explains whether data is sent externally, and do not provide an API key until the service and retention behavior are documented.
The activation guidance is generic enough that the skill could be invoked for broad 'utility' or 'filesystem' tasks outside a narrowly intended compare use case. Over-broad routing increases the chance an agent will select this skill unnecessarily, which can expose local file contents or trigger downstream processing without clear user intent.
The skill requires an API key but does not disclose what external service uses it or whether file contents may be transmitted off-host. This lack of transparency can lead users or orchestrators to pass sensitive files into a skill that may send data to a third party, creating confidentiality and secret-handling risks.
No suspicious patterns detected.
