Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-indexing skill whose broad local indexing and watch examples are disclosed and purpose-aligned, but users should enable them deliberately.
Install only if you want a skill that can read Markdown documentation and store extracted metadata in docs.db. Prefer one-time indexing or narrow --dir/--file targets before using watch mode, and avoid pointing it at directories containing private notes unless you want those indexed.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
// - Konfigurationsoptionen
const docInfo = await docScraper.extractMarkdown({ file: "skills/my-skill/SKILL.md", extract: ["title", "description", "usage", "config"] });
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
// - Konfigurationsoptionen
const docInfo = await docScraper.extractMarkdown({ file: "skills/my-skill/SKILL.md", extract: ["title", "description", "usage", "config"] });
The skill explicitly describes a watch mode that continuously monitors markdown files and automatically updates docs.db, but the documentation does not mention consent, visibility, scope restrictions, or safeguards around persistent monitoring and modification. In an agent setting, silent background watching and automatic writes can lead to unexpected data collection or changes to shared state, especially if users do not realize the process continues after initial invocation.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
// doc-scraper extrahiert
// workspace-db speichert/organisiert
const extracted = await docScraper.extract('skills/my/SKILL.md');
// Übergabe an workspace-db
await workspaceDb.syncDocument({
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
// doc-scraper extrahiert
// workspace-db speichert/organisiert
const extracted = await docScraper.extract('skills/my/SKILL.md');
// Übergabe an workspace-db
await workspaceDb.syncDocument({
The file uses German instructional text for the skill description and subsequent sections, but does not indicate that German is optional or required for a region-specific reason. This can violate language/locale policy when users are not given a choice or clear justification.
No suspicious patterns detected.