Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent change-management advisor with a local template-generating script and no evidence of hidden data access, persistence, network use, or destructive behavior.
Installers should understand that this skill can invoke Bash to run its included Python assessment helper, but the reviewed helper only prints change-management planning outputs. Avoid pasting sensitive business details unless needed for the advisory task, and override the locale/style in your prompt if Canadian English is not desired.
The trigger list is broad and generic enough that the skill could be invoked in situations where the user did not explicitly intend to call a change-management specialist. Unintended invocation can cause context leakage into the wrong workflow, produce irrelevant authoritative guidance, or increase the chance that Bash-enabled actions are exposed more often than necessary.
The output-style instructions require "Canadian English" unconditionally. This imposes a locale preference without indicating that the user can choose another language or locale, which fits the policy's language/locale violation criteria.
No suspicious patterns detected.
