Security audit
Security checks for vulnerabilities and agentic risk
This is a small hash-verification skill with no bundled executable code, but its documentation is broad and asks for an API key without enough handling guidance.
Before installing, confirm what HASH_API_KEY is for and avoid hardcoding or printing it. Also note that the referenced verifier script is not included in this artifact, so the skill may be incomplete unless supplied elsewhere.
This markdown file describes when to use the skill with broad phrases like 'validation related functionality', 'Automating hash tasks', and 'Security operations' without clearly defining scope or exclusions. These descriptions are generic enough to overlap with many unrelated requests and do not provide negative examples or specific trigger constraints.
The skill requires a credential via an environment variable but provides no warning about secure handling, storage, redaction, or avoiding exposure in logs and shell history. In security-oriented workflows, this can lead users to mishandle the API key, increasing the risk of credential leakage and unauthorized use of the backing service.
No suspicious patterns detected.
