Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only construction reporting assistant that structures user-provided project information and does not include code, persistence, data exfiltration, or automatic sending behavior.
Safe to install for construction progress reporting. Review reports before sharing them, avoid unnecessary personal contact details, and be careful with commercial disputes, payment amounts, claims, and site photos intended for external stakeholders.
The activation examples include generic phrases such as asking for help with a project report or progress update, which could cause the skill to trigger in broader workplace conversations than intended. Over-broad activation increases the chance that unrelated or sensitive business discussions are pulled into this reporting workflow and transformed into a structured stakeholder-facing document.
The skill explicitly collects names/roles for a distribution list and prepares content for clients and management, but provides no privacy or confidentiality guardrails. This can lead users to disclose personal data, commercially sensitive project information, dispute details, or stakeholder contact information without warning or minimization, increasing risk of inappropriate sharing or retention.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
1. **Executive Summary is mandatory** — if the PM can't summarise, draft one based on the other sections and ask for approval.
2. **Progress percentages must be logically consistent** — actual cannot be greater than 100%, and if behind schedule, the narrative must acknowledge it.
3. **Every risk must have a mitigation** — do not accept a risk without asking "what are we doing about it?"
4. **Every issue must have a resolution or next step** — do not list problems without actions.
5. **Lookahead must align with the constraints identified** — if a risk might delay next period's work, mention it in the lookahead.
6. **Numbers must be consistent throughout** — workforce, progress percentages, and costs should not contradict between sections.