Security audit
Security checks for vulnerabilities and agentic risk
This skill package helps draft incident and status communications and only asks the agent to use a disclosed local context file, with no hidden execution or data export found.
Installers should be comfortable with the setup skill reading limited project files to draft `.agents/status-page-context.md` and writing that context file for future status communications. Review drafts before posting them publicly, especially incident details, timestamps, customer impact, and any approval requirements.
The description says to use the skill when the user 'needs to communicate a service disruption to users,' which is a broad natural-language condition rather than a narrowly scoped trigger phrase. Because this file is markdown with manifest front matter, that ambiguity could cause unintended invocation for many general communication requests related to outages or disruptions.
This JSON eval file is a manifest-type file, so vague trigger review applies. The phrase "help me write something" is highly generic and could match many unrelated user requests, making the maintenance skill's boundary insufficiently specific in this test case.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- [ ] Incident commander role is defined
- [ ] Communications lead role is defined
- [ ] Update cadence is set (e.g., every 30 min during critical)
- [ ] Approval process is clear (who signs off, or "no approval needed")
### Notification Channels
- [ ] All active channels are checked
This JSON eval file contains natural-language requirements that the skill output 'includes approximate start time in UTC.' Similar UTC-only requirements appear elsewhere in the file. Because the policy category applies to all file types and flags forced locale choices without opt-in or justification, this is a mild language/locale policy concern.
The assertion requires a timestamp in UTC, which is a locale/time-format constraint expressed in natural language. The file does not indicate that users may choose another timezone or that UTC is mandated for a documented operational reason.
This line requires exact start and end times in UTC. Under the stated policy, forcing a locale-specific convention across outputs can be a violation when there is no opt-in or clearly documented justification.
No suspicious patterns detected.