Security audit
Security checks for vulnerabilities and agentic risk
The skill provides a proportionate local drafting workflow, but its checks are incomplete and its optional Windows app needs separate review.
Manually verify 70-character fields and completed sections; a clean lint report does not guarantee compliant copy. Choose an output folder where replacing lint-report.md is acceptable. The optional Windows app is unnecessary for this workflow and requires its own security review; the supplied checksum alone does not establish safety.
The code implements only a partial draft linter, not the declared generation-and-linting workflow. Its hype-word checks align with the description, but generation and the distinct 70-character field check are absent. Local file reading and report writing are supporting implementation details, not unrelated capabilities.
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest promises linting for both 70- and 150-character fields, but MAX_CHARS is fixed at 150 (L086) and applied uniformly to every line without identifying fields. Consequently, a headline exceeding 70 characters but fitting within the universal limit can pass without a length warning.
No suspicious patterns detected.
