Security audit
Security checks for vulnerabilities and agentic risk
This is a broad command-reference skill with disclosed file, process, and network examples, but no hidden code, persistence, credential handling, or automatic execution.
Install only if you want a broad shell-command reference skill. Before using it, review generated commands carefully, especially delete, in-place edit, kill, rsync, and curl commands; require explicit paths, ports, and URLs and avoid sending secrets or local file contents unless you intentionally requested that destination.
The skill description is framed as a general-purpose utility for 'everyday labor' and broad categories like file manipulation, system commands, and text processing. That overly broad scope can cause the skill to be invoked in many contexts, including sensitive ones, increasing the chance an agent applies powerful shell operations without clear task-specific guardrails.
The skill includes destructive and high-impact commands such as file deletion, in-place edits, process killing, and network requests, but it does not provide explicit warnings, confirmation requirements, or safety constraints. In an agent context, this makes accidental data loss, service disruption, or unintended outbound requests more likely because the examples normalize direct execution of risky commands.
The documented curl examples support downloading from arbitrary URLs and sending POST requests with data to arbitrary endpoints, which enables external transmission. In a skill for agents, this is dangerous because it can facilitate exfiltration of local data or unauthorized communication with remote services if the agent incorporates user or environment data into those commands.
lsof -i :PORT
# Download with retry
curl --retry 3 -O URL
# Test endpoint
curl -X POST -H "Content-Type: application/json" -d '{"key":"value"}' URL
No suspicious patterns detected.