Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a SaaS planning helper, but it broadly claims subagent orchestration and development workflow control without clear limits or confirmation steps.
Install only if you want a broad SaaS planning/orchestration prompt pack and are comfortable reviewing each generated research, build, marketing, or launch task before execution. Do not let it autonomously spawn agents, create accounts, configure payments, post publicly, or modify real business systems without explicit approval.
The declared description claims a substantial orchestration capability for SaaS operations, but the actual code chunk does not implement any of those behaviors. It is a minimal example script whose only runtime effect is printing a placeholder message. This is a material description-behavior mismatch because the code's primary purpose is not SaaS orchestration at all; it is effectively a stub/demo file.
The description overstates the skill's functionality. The script does provide a narrow form of project and revenue target tracking by summarizing project statuses and MRR progress, which partially aligns with 'track projects' and 'manage revenue targets.' However, its primary behavior is reporting only: it reads no real project sources, uses mock in-memory data, performs no orchestration, spawns no subagents, and does not coordinate workflows. The actual code simply generates and optionally saves a status report, so the declared purpose is materially broader and different from the implemented behavior.
The declared description presents this skill as a comprehensive SAAS operations orchestrator with multiple management capabilities. The supplied code only creates a formatted build brief from command-line inputs and writes it to disk. Although the text says it is a 'spawner' and mentions being 'ready to spawn subagent,' there is no code that launches another agent or system process. There is also no functionality for project tracking, revenue monitoring, or coordinating development workflows across products. The actual primary purpose is task-template generation for an MVP build mission, which is materially narrower than the declared description.
The declared description presents a much broader orchestration system for SaaS operations, including subagent spawning, project tracking, revenue management, and workflow coordination. The supplied code only constructs a research brief, outputs it to stdout, and writes it to a file. While the script is thematically related to SaaS idea research and mentions being 'ready to spawn' a subagent, it does not actually invoke or manage any subagent, nor does it perform the other operational capabilities claimed in the description. This is a material description-behavior mismatch.
Without declared permissions the skill's intent is opaque and cannot be validated.
The invocation condition is broad enough that the skill could be selected in many loosely related business or software contexts, increasing the chance it is applied when unnecessary or without proper scrutiny. In a skill that claims to orchestrate subagents and development workflows, over-broad routing can expand the operational blast radius and lead to unintended actions by downstream components.
The skill provides broad, always-on research instructions without clear activation boundaries, input constraints, or guardrails on data sources and permissible actions. In an agentic environment, this can cause the skill to trigger in overly broad contexts, leading to unnecessary external research, scope creep, or collection/processing of sensitive business information beyond what was intended.
The file-level documentation describes a 'Factory Status Checker' that gives a quick overview of active projects and their health, which suggests reporting/inspection behavior. However, the implementation also persists that report to disk by creating a timestamped text file, adding a write side effect not indicated by the status-checking description.
No suspicious patterns detected.
