Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent industry and keyword research workflow that uses disclosed research services and writes a local research brief.
Before installing, expect this skill to send research queries, seed keywords, competitor URLs, and possibly derived client context to third-party research services if configured. Review the generated `.agents/industry-research-{client}.md` file before letting other workflows rely on it.
The activation criteria are very broad and overlap with many generic research or marketing requests, which can cause the skill to trigger in situations the user did not explicitly intend. Because the skill performs multi-tool web research and writes artifacts, over-activation increases the chance of unnecessary external data access and unintended file creation.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
### Step 1: Keyword Research (Ahrefs)
Use Ahrefs to gather keyword data. Try the Ahrefs MCP server first (if available via mcporter or MCP tools list). If MCP is not available, fall back to the Ahrefs REST API at `https://api.ahrefs.com/v3` with `Authorization: Bearer $AHREFS_API_KEY`.
Regardless of access method, gather data from these endpoints/capabilities:
The skill directs the agent to write a local artifact file without any requirement to notify the user or obtain consent. This creates a transparency and integrity issue: users may be unaware that persistent files are being created, and downstream processes may consume those artifacts as if they were intentionally requested.
No suspicious patterns detected.