Security audit
Security checks for vulnerabilities and agentic risk
The skill is a Markdown-only build planner, but it broadly encourages unattended autonomous coding that can modify project files over time without clear approval or containment requirements.
Install only if you want a broad coding-workflow planner. Keep autonomous cron or spawned-session use disabled unless you run it in a dedicated project directory, review planned file changes first, and have a clear way to stop scheduled runs.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
## Security Checklist
- [ ] No API keys hardcoded (use env vars)
- [ ] No .env loading in scripts
- [ ] All secrets in config, not code
- [ ] Input validation
- [ ] Error handling
The skill's activation and usage criteria are very broad ('build anything', autonomous or user-driven), which can cause the agent to invoke it in situations the user did not clearly intend. In an agentic system that writes plans, tasks, and code artifacts, ambiguous triggering increases the risk of unnecessary file modification or autonomous execution on loosely related prompts.
The skill explicitly promotes cron-based autonomous building and iterative updates to project files, but it does not require an explicit warning, opt-in, or confirmation before modifying files over time. This creates a real risk of unattended changes, drift, or unintended writes in the workspace, especially when the skill can be run via scheduled automation.
No suspicious patterns detected.