Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed protobuf compatibility checker that reads proto files or git history and reports breaking changes without persistence or unrelated data access.
Installers should understand that this checker may read .proto files from the selected directories or git refs and may run local git commands to inspect history. Its main risk is imperfect detection accuracy, so treat findings as a compatibility aid rather than a complete protobuf verifier.
The manifest and detector table explicitly state that SM003 covers "Service name or package changed," implying rename detection for services. In the implementation, SM003 is only emitted for package changes or full file removal, while service name changes are treated as a removed service plus a new service rather than an actual rename detection.
This markdown skill description shows invocation examples followed by free-form requests like "Compare proto files" and "Check if my .proto changes..." without defining a constrained trigger vocabulary or exclusion conditions. That makes activation scope ambiguous and increases the chance the skill could be invoked by ordinary protobuf-related conversation rather than an intentional command.
The inline comment says "Entire message removed — check if any service references it," which describes conditional logic based on service usage. The actual code immediately appends a breaking change for every removed message and performs no reference analysis, so the comment actively misstates what the code does.
No suspicious patterns detected.
