Security audit
Security checks for vulnerabilities and agentic risk
This is a reference-only skill for compressing other skills, with disclosed local calibration logging and no evidence of hidden execution, exfiltration, or destructive behavior.
Before installing, decide whether local calibration history is acceptable in your workspace. If you use cloud LLM provider keys, compression content may be processed by that configured provider; use a local provider if the skills being compressed contain sensitive material.
Referenced artifact was not completely inspected
anually verify you're using `--threshold=0.95` or higher. The formula variant (`SKILL.md`) should never be the input for self-compression.
The skill specifies persistent logging of compression runs and later user feedback into a local .learnings/skill-distiller/calibration.jsonl file, including timestamps, skill names, token counts, and free-form outcome data, but does not clearly warn users that this data will be retained on disk. In context this is not overtly malicious, but it creates a privacy and data-governance risk because sensitive project names, prompts, metadata, or feedback details may be stored longer than users expect and could later be exposed to other local users, backups, or source control.
No suspicious patterns detected.