Security audit
Security checks for vulnerabilities and agentic risk
This skill performs a narrow public GitHub update check and writes a Markdown report, with no evidence of hidden code, credential access, persistence, or destructive behavior.
Before installing, be aware that the skill will browse public GitHub pages and may create a local Markdown report under report_v1 for the selected date/version. Users outside the Asia/Shanghai timezone should verify the intended research date before running it.
The instruction fixes the research date to the previous day in the Asia/Shanghai timezone, which imposes a locale-specific behavior. The file does not offer user opt-in or explain why this timezone is required for the skill's purpose.
The skill explicitly instructs the agent to create a Markdown report at a concrete filesystem path, but it does not disclose that behavior or require user confirmation before writing files. This can cause unintended local state changes, overwrite existing content in matching directories, or surprise users who expected a read-only research task.
No suspicious patterns detected.
