Security audit
Security checks for vulnerabilities and agentic risk
The bundled workflow has proportionate local access, but its review analysis is limited and the optional Windows app needs a separate trust decision.
Check that counts come from actual review text, and verify every factual claim against supporting evidence before publishing. Use a dedicated output folder because the report can be overwritten. The Windows app is unnecessary for the bundled workflow; assess it separately before running it, since a matching publisher-provided hash does not establish safety.
The code implements the review-theme tallying component, but not the declared primary deliverable of writing product descriptions or the promised claim verification. Its guardrails are fixed text in the report, not enforced checks. Local input reading and report writing are consistent supporting operations; no unrelated resource access or hidden capability is evident.
Without declared permissions the skill's intent is opaque and cannot be validated.
No suspicious patterns detected.
