Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only internal communications skill, but it tells agents to broadly search company Slack, email, calendar, and documents without clear user consent or scope limits.
Review before installing in a workplace account. Use it only where the agent is already authorized to access the relevant internal sources, and constrain requests to specific channels, documents, date ranges, and approved audiences. Avoid using it to summarize HR, legal, security, customer-sensitive, or access-controlled material unless explicitly approved.
The skill description is broad enough that an agent may invoke it for many generic writing or update requests, not just the narrowly intended internal-communications cases. Over-broad auto-activation can cause prompt-scope hijacking, where this skill's instructions override a more appropriate skill or cause unnecessary loading of additional files and guidance.
The keyword list includes generic triggers such as 'updates' and 'weekly update', which are likely to match many ordinary requests unrelated to this specialized skill. In agent routing systems, such ambiguous keywords can lead to unintended skill selection, increasing the chance of instruction collisions, wrong formatting, or accidental use of internal-comms templates in unrelated contexts.
The skill explicitly directs the agent to pull content from Slack, Google Drive, Email, and Calendar to draft updates, but it provides no requirement to obtain user confirmation, limit scope, or warn that sensitive internal communications and documents may be accessed. In an internal-comms context, those sources commonly contain confidential business, personnel, legal, and customer information, so indiscriminate retrieval can cause unnecessary data exposure or over-collection.
The skill explicitly instructs the agent to mine internal Slack, email, calendar, documents, and external press to assemble a company-wide newsletter, but it does not require user confirmation, data-minimization, or any warning that sensitive internal content may be accessed and summarized. In this context, the danger is unauthorized aggregation and redistribution of confidential or broadly visible-but-still-sensitive company information into a new artifact, increasing the risk of privacy, confidentiality, and need-to-know violations.
No suspicious patterns detected.
