Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent, but it asks users to run an unpinned npm package with a wallet private key, which deserves manual review before installation.
Review this before installing. Use only a dedicated low-balance wallet, prefer a pinned and independently verified package version, avoid sending confidential drafts or sensitive source material, and understand that checks send content to an external service for paid review.
The skill instructs the agent to tell the human the draft was checked only if it passed, or otherwise merely disclose remaining issues. That creates an integrity and transparency problem because review failures can be concealed or ambiguously represented, allowing unsafe or unreviewed outputs to be presented without clear notice that the check failed.
This is not just a documentation nit: it operationally instructs execution of remote code with live wallet-related environment variables. Even though the skill recommends a low-balance dedicated wallet, compromise could still steal funds, private keys, or sensitive document contents, making the issue materially dangerous in context.
No suspicious patterns detected.
