Security audit
Security checks for vulnerabilities and agentic risk
This markdown-only skill is mostly aligned with ADHD project management, but it includes under-scoped workplace monitoring and coercive health-adjacent interventions that users should review carefully.
Install only if you are comfortable with an ADHD-focused project-management assistant that may suggest Slack reminders and workplace activity monitoring. Before use, require explicit opt-in from affected engineers, limit monitored signals and retention, avoid coercive or medical-authority language, and keep any Slack/calendar/GitHub integrations user-controlled.
The markdown explicitly states the skill is 'NOT for' neurotypical project management and frames alternative cognitive styles as out of scope. This is a natural-language policy concern because it imposes a user-attribute-based restriction rather than offering the guidance as an optional specialization or clearly documenting a compliance-driven limitation.
The skill proposes monitoring sensitive workplace behavior signals such as Slack DND status, calendar blocks, and commit activity to infer mental/work states, but it does not mention consent, notice, scope limits, or data-handling safeguards. In this context, the absence of privacy controls makes the monitoring intrusive and susceptible to misuse by managers or integrations that track employees without informed opt-in.
The documented 'FIRM interrupt' directs a physical visit or video call and labels the break 'non-negotiable' without establishing prior consent, emergency criteria, or organizational authority. In an ADHD-focused workplace support skill, that coercive framing raises the risk of harassment, inappropriate escalation, and harmful intervention against user autonomy.
The intervention logic is ordered incorrectly: once the hyperfocus duration exceeds 10 hours, the 6-hour condition still matches first and returns early, preventing the mandatory-break path from executing on that check. In a wellbeing-monitoring skill, this creates a safety-relevant logic flaw because the strongest intervention may be delayed or skipped when the engineer is in the longest uninterrupted work session.
The message falsely invokes medical authority by saying the break is 'doctor's orders' when no such authority is established. This is deceptive and can improperly pressure the recipient into compliance, especially in a health-adjacent skill aimed at neurodivergent users.
This markdown file includes behavior that sends Slack direct messages and schedules recurring reminders, but the surrounding documentation does not explicitly warn users that the system will proactively contact engineers on a timed basis. For a reminder system that may message users repeatedly, a brief user-facing disclosure would help set expectations and avoid surprise or annoyance.
No suspicious patterns detected.
