Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent token-cost helper, but it advises storing user documents, code, and contracts in a vector database without clear privacy, consent, retention, or deletion safeguards.
Review this skill before installing if you may use it with private documents, source code, contracts, customer data, or regulated information. The calculator itself is low-risk, but any implementation of the caching advice should require explicit consent, minimization/redaction, access controls, retention limits, and a deletion path.
This markdown file describes activation with a loose list of topics such as 'token savings' and 'cost analysis' without defining clear trigger boundaries or exclusions. Those phrases are broad enough to overlap with general conversation, which can cause unintended invocation of the skill.
The guidance recommends storing user-provided documents, code, and contracts in a vector database to answer later questions, but it provides no privacy, consent, retention, access-control, or deletion guidance. That omission can lead implementers to persist sensitive or regulated data in embeddings or indexes without safeguards, increasing the risk of unauthorized disclosure or improper data handling.
The FAQ cache example answers a generic weather question with a Beijing-specific response, implicitly forcing a locale in natural-language content. Because no user locale choice or justification is provided, this can violate language/locale policy expectations for user choice.
No suspicious patterns detected.
