Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward API launch checklist with reference notes and a small local markdown-generation script.
Review generated launch plans before publishing or running outreach, and invoke the script only with an intended input JSON and output markdown path. The skill may guide marketplace changes such as pricing, auth configuration, listings, and outreach, so users should approve those business actions explicitly.
The skill references a local script and additional repository files, implying file read/write capability, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this can lead to over-broad tool access being inferred or granted implicitly, increasing the chance of unintended file access or modification beyond the skill's intended purpose.
The description contains broad activation language such as 'use when a user wants to publish APIs, fix gateway/auth/test failures, configure plans, optimize listing conversion, run outreach, or package and sell an API-launch workflow skill,' which spans multiple loosely related tasks. Overly broad routing criteria can cause the skill to activate in situations outside its intended boundaries, leading to inappropriate file operations, script use, or business guidance being applied to unrelated requests.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
5. Convert first paid users and collect feedback.
"""
out.write_text(md, encoding='utf-8')
print(f'Wrote {out}')
No suspicious patterns detected.