Security audit
Security checks for vulnerabilities and agentic risk
This is a local brand voice analysis and prompt generation helper, and the flagged issues are consistent with its stated purpose rather than hidden unsafe behavior.
Before installing, be comfortable with the skill analyzing writing samples you provide and producing brand voice prompts. Provide only intended corpus or JSON files, and review generated system prompts before deploying them in another system.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Never break voice for clarity alone — rephrase to stay on-brand.
When prohibited words appear in input, replace with a preferred equivalent silently.
"""
return prompt.strip()
# ------------------------------------------------------------------
The skill references local scripts and repository files but does not declare any explicit tool scope or permissions boundary. That creates ambiguity about what file access the agent may assume is allowed, which can lead to over-broad file reading in environments where skills are automatically granted workspace access.
The trigger guidance explicitly says to activate for loosely related requests like 'make our writing more consistent' or 'what tone should we use,' which broadens invocation beyond clear user intent. Over-triggering can cause the skill to process unnecessary content or steer conversations into script/file-backed workflows when the user did not request that level of analysis.
This natural-language instruction imposes a specific linguistic policy ("Use first-person plural (we/our)") on outputs. Under the policy rule, forced language/style constraints can be a violation when they are mandated without offering the user a choice or documenting why the restriction is required.
No suspicious patterns detected.