Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed daily research digest, but users should understand that it may run scheduled web searches and save digest state locally.
Install only if you are comfortable with an agent using your configured project keywords to query external services and saving daily digests plus seen URLs under state/. Configure narrow keywords, avoid confidential internal project names, and confirm any automated schedule before enabling it.
The skill directs searches across X, YouTube, Reddit, GitHub, and real-time web search providers but does not clearly warn that user interests, project keywords, or prompts may be transmitted to third-party services. This creates a privacy risk because active-project context can reveal sensitive research priorities, commercial plans, or internal topics.
The manual triggers are broad enough to match ordinary conversational requests like general research or status-check prompts, which can cause the skill to activate without clear user intent. In this skill, unintended activation is meaningful because it initiates multi-source internet searches and may create persistent digest files, expanding both privacy and side-effect risk.
The skill instructs persistent writes to local state files and output digests without clearly warning the user that local state will be modified. Silent persistence can surprise users, leak prior activity across sessions, and create unwanted retention of browsing and project-interest data.
The description says the agent runs automatically each morning before the user's first session, and later sections prescribe a 06:00-07:00 local-time schedule. This imposes a specific time/locale convention without indicating that users can choose a different schedule or opt in.
No suspicious patterns detected.
