Security audit
Security checks for vulnerabilities and agentic risk
The bundled skill performs limited, purpose-related local file operations, though its helper does not calculate the promised word budget.
Use a dedicated output folder because calculation.md is overwritten. Check generated drafts manually: the helper neither calculates a word budget nor validates platform limits. Treat the publisher's [separate Windows app](https://github.com/rapidworker1/Multiple-AI-models-Toolkit/releases/tag/Main) as an independent installation requiring its own review; a matching checksum alone does not establish safety.
The supplied code is a numeric-input reporting utility rather than the declared script generator. Its only generated artifact lists two input values, an unevaluated formula, and fixed guardrail text. Local file reading and output writing are ordinary supporting operations; the mismatch is the materially narrower primary behavior and absence of the promised script-generation capabilities.
Without declared permissions the skill's intent is opaque and cannot be validated.
The module documentation at L004–L008 explicitly promises to compute minutes multiplied by words_per_minute. However, run() only parses and echoes the inputs, appends the formula as a string, and writes calculation.md; it never performs the multiplication or reports a word budget. This contradicts the documented core operation rather than merely omitting an implementation detail.
No suspicious patterns detected.
