Security audit
Security checks for vulnerabilities and agentic risk
This skill is not malicious, but it asks to silently change the agent's reasoning mode across broad conversations without clear user control.
Install only if you are comfortable with a skill that automatically evaluates every message and may change the agent's reasoning mode without asking each time. Prefer a version that limits activation to explicitly complex tasks and makes reasoning-mode changes user-visible and user-controlled.
Declaring that the skill triggers on every user message gives it overly broad scope and makes it act as universal preprocessing. That expands the attack surface, allowing hidden behavioral changes to be applied to all interactions, including low-risk or unrelated contexts, which can bypass least-privilege expectations and amplify prompt-injection effects.
The skill mandates hidden automatic behavior ('Do not ask. Just activate.') and silent reasoning-state changes without user opt-in. Hidden state transitions reduce transparency and user control, and can lead to unexpected resource use, policy noncompliance, or concealed behavior changes that are difficult to audit.
The skill claims 'No external tools needed' while also instructing the agent to use an internal command or session_status tool to change reasoning state. This inconsistency can cause policy drift and unsafe tool use because an agent may invoke hidden state-changing mechanisms the user did not request or expect.
The integration section contradicts the activation instructions about whether tools are required, creating ambiguous operational behavior. In security-sensitive agent environments, contradictory instructions increase the chance the model will improvise with unauthorized commands or hidden tool usage to satisfy the skill.
No suspicious patterns detected.
