Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does robot task decomposition, but it also allows persistent edits to its action definitions without requiring explicit user approval.
Review this skill before installing if you use it for robotics workflows. Its decomposition and validation behavior is straightforward, but action-bank changes should be treated as configuration changes: require explicit approval, inspect any proposed diff, and avoid letting routine decomposition requests silently expand the robot action vocabulary.
The documented purpose is image-plus-instruction task decomposition, but the described behavior expands into validation, action-bank management, duplicate checking, and file-oriented operations. This mismatch is dangerous because users and orchestrators may invoke the skill under false assumptions, while the skill performs broader text and file processing than its declared scope suggests.
The skill references local files such as action-bank.md and examples.md but does not declare any explicit tool scope or permissions boundary. In an agent environment, undocumented file-read capability can lead to unintended access to workspace files and makes the skill's effective behavior less auditable and harder to constrain.
The trigger conditions are broad enough to match generic requests about decomposition or step-by-step actions, which increases the chance of unintended invocation. In agent systems, accidental routing to a skill with file access or behavior beyond its primary purpose can expose context, produce unsafe outputs, or trigger side effects the user did not request.
The skill first requires all subtasks to use a fixed allowed action bank, then later permits inventing and adding new actions. This contradiction undermines the safety boundary implied by the action bank and enables policy bypass by redefining or extending the action set whenever a requested task does not fit existing constraints.
The documentation broadens the skill from decomposition into modifying the shared action bank, which is effectively a persistent configuration/code change. That creates a supply-chain style risk: a routine task-decomposition invocation could alter future behavior of this or other skills without clear approval or isolation.
The documentation authorizes modification of action-bank.md without requiring explicit user warning or confirmation, despite this being a persistent file change. Silent mutation of a shared action definition file can alter downstream robot behavior and create an integrity risk that persists beyond the current session.
No suspicious patterns detected.
