Security audit
Security checks for vulnerabilities and agentic risk
This skill is not overtly malicious, but it needs review because it can trigger on generic help questions and steer users toward third-party skill installation without clear guardrails.
Only install this if you specifically want an agent to suggest and help install skills from an open ecosystem. Review any recommended third-party skill separately, and prefer a version with narrower activation language and explicit confirmation before installation.
There is a mismatch because the description does not accurately represent any concrete behavior, and the code itself does not implement a meaningful skill capability. The declared purpose is effectively nonspecific, while the actual code is just a standalone numeric literal with no operational functionality, triggers, or resource access.
The phrase covering 'how do I do X' where X might be a common task is underspecified and can match many ordinary requests that do not imply the user wants external skill discovery. Because this skill is tied to an open skills ecosystem, accidental invocation could steer users toward third-party extensions unnecessarily and expand attack surface.
The activation condition is broad enough to trigger on generic capability questions like 'can you do X,' which can cause the skill to activate in contexts where the user did not explicitly ask to browse or install third-party skills. In a skill that leads to discovery and installation from an open ecosystem, overbroad invocation increases the chance of unnecessary exposure to untrusted external content or supply-chain style risk.
