Security audit
Security checks for vulnerabilities and agentic risk
This Vulkan helper is a disclosed, workspace-local documentation and notes cache with narrowly scoped scripts and no evidence of deception or harmful behavior.
Install this only if you want the agent to make a workspace-local .Vulkan-Encyclopedia directory, fetch selected official Vulkan documentation, and save Vulkan-specific notes. Review the notes it creates in sensitive repositories, and avoid letting it record secrets or private access details.
The skill also references workspace-initialization and repair scripts that create or modify directories and files, which exceeds a narrow 'answer Vulkan questions' description. This is dangerous in agent environments because setup/repair utilities can change local state and are materially different from passive analysis, making it easier to over-grant trust or trigger unintended modifications.
The skill also references workspace-initialization and repair scripts that create or modify directories and files, which exceeds a narrow 'answer Vulkan questions' description. This is dangerous in agent environments because setup/repair utilities can change local state and are materially different from passive analysis, making it easier to over-grant trust or trigger unintended modifications.
The skill directs the agent to fetch remote documentation and write cached copies to the local workspace, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a least-privilege failure: a caller may invoke a skill that can perform network and filesystem actions beyond what its manifest transparently communicates, increasing the risk of unintended data writes, unexpected external access, or misuse in broader agent contexts.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Treating local observed engine/project behavior as if it were guaranteed authoritative Vulkan behavior.
- Dumping large amounts of low-value docs into the workspace without a reason.
- Writing project-specific observations into the official-doc cache tree.
- Making high-confidence claims about synchronization/valid-usage details without checking the spec when exact behavior matters.
The manifest describes a Vulkan-spec/reference workflow for answering Vulkan API questions, which clearly justifies consulting Vulkan documentation. However, this file goes beyond passive reference use by explicitly directing the skill to fetch remote content and maintain a local cache of it. That network-fetching and local persistence behavior is not stated in the manifest description.
No suspicious patterns detected.