Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed deep-research workflow that uses web search and report generation, with some usability and packaging caveats but no artifact-backed malicious behavior.
Install this if you want a long-form research-report workflow and are comfortable with it performing web searches and creating a PDF. Before relying on PDF generation, verify that the missing md_to_pdf.py script comes from a trusted source, and avoid giving sensitive private research topics unless external search is acceptable.
The activation description is broad enough to trigger on many generic research-related requests, which can cause the skill to engage unexpectedly and steer conversations into long-form web research and report generation. While not overtly malicious, this increases the chance of unanticipated tool use and scope expansion without clear user intent.
The skill promises a PDF as the final output but does not disclose that a file will be created as a side effect. Hidden file creation can surprise users, create storage/privacy issues, and normalize executing output-producing workflows without explicit consent.
The skill mandates online searching and parallel sub-agent collection without notifying the user that external network requests will occur. This can expose user-supplied topics or sensitive interests to third-party services and causes undisclosed data egress beyond the local conversation context.
The instruction to use a local conversion script introduces code execution and file-generation behavior without explaining what the script does, what dependencies it invokes, or what files it reads and writes. Even if intended for formatting, undisclosed script execution increases the attack surface and can lead to unsafe local side effects if the environment or script is modified.
No suspicious patterns detected.
