Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward privacy-policy text generator and checker with no hidden network, persistence, credential, or destructive behavior.
Before installing, understand that this is a template generator and simple keyword checker, not legal advice. The check command reads the policy file path you provide locally, and generated privacy policy text should be reviewed for your actual data practices and applicable laws.
The trigger list is broad and generic, including terms like 'privacy policy' and 'GDPR privacy' without qualifiers that limit when the skill should activate. This can cause the skill to be invoked in loosely related contexts, increasing the chance of unintended execution, irrelevant policy generation, or interference with other more appropriate skills.
This shell script invokes python3 to process a user-supplied file, which is a subprocess execution covered by the missing-warning rule for code files. While the operation is not hidden in a malicious sense, there is no explicit disclosure in comments, prompts, or surrounding messaging that the check command launches Python as part of its behavior.
No suspicious patterns detected.
