Security audit
Security checks for vulnerabilities and agentic risk
This skill creates standard architecture decision record documents in a repository and does not show hidden, networked, credential-seeking, or destructive behavior.
Install this if you want the agent to create and maintain ADR documentation in your repository. Be aware that invoking it will write documentation files and may update an ADR index, so review the generated ADR before committing it.
This instruction explicitly tells the agent to create docs/adr/ without asking permission, normalizing unapproved filesystem mutation as a default behavior. That increases risk because it removes a consent checkpoint and can be chained with ambiguous prompts or malicious plan inputs to cause unauthorized writes in the workspace.
The skill directs the agent to write a new ADR file and modify an index file as part of normal execution, but it does not require any explicit user confirmation or even a user-facing warning before making filesystem changes. In an agent setting, this can lead to unintended repository modifications, noisy commits, or abuse where a loosely phrased request causes silent persistent changes the user did not expect.
