Security audit
Security checks for vulnerabilities and agentic risk
This skill is a planning-template skill that writes implementation plan documents and does not contain hidden execution, network access, credential use, or destructive behavior.
Install this only if you want an agent to create persistent planning markdown files in your repository. Before letting a generated plan be executed, review the plan, confirm any subagent handoff, and require approval before git add or git commit commands are run.
The skill instructs the agent to save output directly into the repository (docs/plans/...) without requiring user confirmation or even warning that a write will occur. In an agentic environment, this can cause unintended repository modification, create clutter or sensitive design artifacts, and normalize state-changing behavior from a planning-only request.
The task template includes git add and git commit commands as a standard step, with no confirmation gate or warning that repository history will be changed. If followed by an execution-capable agent or copied automatically into a workflow, this can result in unauthorized commits, polluted history, and accidental inclusion of sensitive or incomplete changes.
The manifest says to use the skill when 'planning complex multi-step tasks that need visual planning artifacts,' which is descriptive but does not define clear boundaries for when the skill should not activate. Because this is a manifest file section within SKILL.md, the lack of negative examples or tighter trigger scope could allow unintended invocation for general planning requests.
No suspicious patterns detected.
