Security audit
Security checks for vulnerabilities and agentic risk
QuickTicket is a planning skill that reads project context and saves local ticket plans, with no executable code or hidden persistence found.
Install only if you want an agent to inspect the current project and create or update local planning tickets. Review the generated ticket files before using them as implementation instructions, and be explicit about the project and destination when invoking it.
The invocation guidance is very broad: phrases like asking to QuickTicket an idea, task, or project and identifying the target from conversation context can match many ordinary planning requests. This can cause the skill to activate when a user did not explicitly intend to invoke it, potentially leading to unsolicited file creation/modification and overcollection of project context for planning.
The README encourages broad trigger phrases such as "Quickticket this project," "Use QuickTicket on this," and an optional shortcut, which can overlap with normal conversational language. In an agent environment, overly generic invocation wording can cause accidental skill activation on unrelated user input, leading to unintentional planning actions, context capture, or file generation.
The skill advertises activation via broad natural-language phrases such as 'Quickticket this project' and 'requests this workflow for ticket planning' without clear scoping constraints. This can cause overbroad or unintended invocation, especially in mixed conversations where a user mentions planning-related phrases incidentally, leading the agent to inspect project context and propose or reconcile tickets in places the user did not explicitly intend.
No suspicious patterns detected.
