Security audit
Security checks for vulnerabilities and agentic risk
This skill creates local proposal drafts for human review, but its renderer has correctness problems that require careful checking.
Treat outputs as drafts. The script expects CSV despite the Markdown quickstart; verify prices, terms, signatures, and unresolved placeholders manually. Use a fresh output folder because matching filenames can be overwritten. The optional unsigned Windows app needs a separate trust decision; matching its supplied hash does not establish safety.
The code supports the proposal-rendering portion of the description, but not its explicit validation claim. It does not verify required fields, inspect signature blocks, check pricing, or report missing information or unresolved placeholders. This is a material functional mismatch, rather than an unrelated or malicious capability.
Without declared permissions the skill's intent is opaque and cannot be validated.
The renderer silently substitutes empty strings for missing CSV fields and writes proposals without checking required scope, pricing, dates, or terms, despite the skill description promising gap checks. Malformed or deliberately incomplete input can therefore produce apparently finished proposals with material omissions, creating financial or contractual risk if users rely on the advertised validation. This is a business-document integrity weakness rather than evidence of malicious behavior or code execution.
No suspicious patterns detected.
