Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local Markdown-frontmatter checker and fixer, with a supply-chain caution because its external MCP dependency is not version-pinned.
Before installing, be aware that this skill uses an external local MCP package and can edit Markdown frontmatter in the folder you choose. Review the proposed file changes before approving them, consider using version control or a backup, and only start checkout if you intentionally want the optional paid certificate.
The skill instructs users to install and execute an MCP server package without pinning a specific version, which means future installs may silently pull a different release than the author reviewed. Because this package is then used as a local tool with file-system access over user-selected folders, a compromised or malicious upstream release could execute unintended code or alter results.
The documentation tells users to run pip install jidoseal-mcp without a version constraint, so installations are not reproducible and may fetch an unexpected newer package. In this skill's context, that package becomes part of the toolchain the agent relies on, so an upstream supply-chain compromise could affect local scanning behavior or execute arbitrary code during installation or use.
No suspicious patterns detected.
