Security audit
Security checks for vulnerabilities and agentic risk
This skill gives an agent a structured debugging workflow with temporary probes and cleanup, and its higher-risk actions are disclosed and tied to debugging.
Install this if you want evidence-first debugging assistance. Before using Autopilot, make sure the project commands and tests are safe for the current environment, and review any temporary probe logs for sensitive data before sharing them.
The skill explicitly directs the agent to add runtime probes and write their output to a repository-local log file. Even though it later says not to put secrets in probe output, debug instrumentation commonly captures request data, environment-derived values, stack traces, or user content, so this creates a realistic risk of sensitive data exposure and unintended workspace modification.
The Autopilot section authorizes the agent to independently run commands, tests, inspect logs, and treat passing machine checks as sufficient completion for machine-only bugs. That increases autonomy in a way that can trigger unintended side effects, especially in projects where tests or debug commands mutate state, contact external services, or operate on production-like resources.
If the user picks `Autopilot`, verify machine-checkable behavior yourself: commands, tests, APIs, logs, CLI/TUI output, and generated files.
Check output assertions, not only exit codes.
Do not ask the user to run a command you can run.
For a machine-only bug, do not add a verification checkpoint. Passing machine checks complete the run.
Ask the user again only for visual, click, touch, or aesthetic judgment.
No suspicious patterns detected.