Security audit
Security checks for vulnerabilities and agentic risk
This is a simple prompt-only work-companion skill with no code, install scripts, credential use, persistence, or hidden data handling, though users should opt into its proactive style deliberately.
Install this only if you want the assistant to make occasional proactive workday check-ins. If unsolicited nudges would be distracting, configure or instruct the assistant to activate it only after explicit opt-in and to keep messages rare.
The trigger description is broad enough that the skill could activate in many loosely related work contexts, including when the user did not clearly request proactive companionship. That can cause inappropriate proactive messaging, reduced user control, and overlap with other skills, especially because the skill is explicitly designed to initiate contact based on inferred rhythm and context.
The high-value trigger list relies on subjective interpretations like the user 'seems to be working alone' or 'dislikes long silent gaps,' which are unsafe as activation rules because they depend on inference rather than explicit consent. In a proactive skill, that ambiguity increases the chance of intrusive or mistimed engagement and can normalize surveillance-like behavior despite the stated boundaries.
The skill name 'work-buddy-en' suggests an English-specific variant, but the file does not explain the locale constraint or indicate that users can opt into another language. Under the policy, forcing a specific language without user choice or documented justification can be a natural-language policy concern.
No suspicious patterns detected.
