Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local AI-text detector whose behavior matches its stated purpose and shows no evidence of hidden access, network transfer, persistence, or destructive actions.
Install only if you are comfortable providing text to a local detector for analysis. Avoid submitting secrets, regulated personal data, or confidential documents unless that is intended, and treat the AI-detection score as advisory rather than proof.
The skill advertises script-based analysis capabilities but does not declare an explicit tool scope or permissions boundary. That creates ambiguity about what file access is intended and can lead to broader-than-expected access being granted or assumed by the agent runtime, especially since user-provided text analysis may involve reading local inputs or reference files.
The invocation guidance lists several trigger phrases, but it also frames activation as any time users want to check whether text was written by AI, without clear scope boundaries or exclusion conditions. Phrases like "check if AI wrote this" and the broad use-case wording could match ordinary conversational requests, increasing the chance of unintended invocation.
The skill explicitly asks users to paste text for analysis but provides no warning about privacy, sensitive data, or handling of proprietary content. Users may submit personal, confidential, academic, legal, or business material under the assumption it is safe to process, increasing the risk of inadvertent exposure or inappropriate retention.
This code reads arbitrary text from a file and processes it for AI-detection, but provides no disclosure when ingesting potentially sensitive user content from disk. For code files, safety-relevant data handling should have some visible user disclosure such as a prompt, log message, or explanatory comment/docstring near the operation.
No suspicious patterns detected.
