Security audit
Security checks for vulnerabilities and agentic risk
This skill broadly activates on most real tasks, may read private knowledge and memory sources, and can update shared skills or project notes, so it needs careful review before installation.
Install only in workspaces where broad knowledge-base and memory lookup is acceptable, and require explicit approval before it updates skills or project experience files. Avoid using it for sensitive client work, private notes, or strict-format outputs unless source access and disclosure rules are narrowed first.
The description says the skill should run before any substantive task, making it effectively universal. Over-broad activation is risky because it forces the agent to apply hidden workflow and retrieval behavior to almost every request, increasing opportunities for privacy leakage, instruction interference, and user-intent override.
The trigger section uses catch-all criteria like all non-chat substantive tasks and anything with an output. Such ambiguous activation language makes the skill hard to bound and likely to fire in situations where scanning internal sources or enforcing process constraints is unnecessary or unsafe.
The skill expands from knowledge loading into modifying other skills and project experience files after task completion. Allowing a skill to direct persistent changes to shared guidance or project memory creates a supply-chain style risk: a bad run, prompt injection, or mistaken conclusion can contaminate future tasks and other agents.
The skill instructs the agent to scan broad internal sources such as Obsidian knowledge bases, memory, and historical task outputs, which goes beyond the narrow purpose of loading only task-relevant prior knowledge. This creates unnecessary data exposure and increases the chance that unrelated sensitive information will be pulled into context or reused inappropriately.
The skill explicitly tells the agent to mine broad memory- and knowledge-derived sources and then disclose what was used in the final output. That combination is risky because it encourages reuse of potentially sensitive internal information and can reveal memory contents, prior work, or user-derived preferences that were not necessary to share.
The skill mandates a fixed Chinese disclosure phrase in every delivery, regardless of the user's language or output format requirements. While not severe on its own, this can cause policy and UX issues by overriding user preferences and leaking internal workflow details into externally facing outputs.
The manifest describes a pre-execution knowledge-loading helper, but the body also imposes post-task reporting, installation guidance, team governance, and knowledge-base maintenance duties. This scope drift is dangerous because it gives the skill authority over behaviors users did not request and can silently alter outputs and system state beyond its stated purpose.
The team-wide requirement to append a fixed Chinese line to every task output imposes a language policy without user consent. This can degrade output quality, violate user expectations, and expose internal process metadata in contexts where it should remain hidden.
No suspicious patterns detected.
