Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent source-code analysis guide, but it repeatedly encourages running unfamiliar code without safety limits or sandboxing guidance.
Review this skill before installing if you often analyze third-party repositories. Use it only with trusted code or inside an isolated sandbox, and avoid running builds, tests, install scripts, or startup commands from unfamiliar projects unless you have inspected them first.
The skill’s activation description is broad enough to trigger on many ordinary code-related requests, which can cause it to be invoked outside its intended narrow use case. Overbroad activation increases the chance that risky guidance in the skill, especially advice to run code, is surfaced in contexts where the repository or code is untrusted.
The skill explicitly recommends validating understanding through actual execution and running code, but provides no warning about the risks of executing untrusted repositories. This is dangerous because code analysis often involves third-party or unfamiliar projects, and following this guidance could lead to execution of malicious build scripts, test hooks, dependencies, or startup code.
The applicability section lists many broad situations without scope limits or exclusions, encouraging activation for generic learning, evaluation, or contribution scenarios. In a security context, broad applicability makes the skill more dangerous because it can steer users toward dynamic analysis of untrusted code even when safer static-only guidance would be more appropriate.
The best-practices section reinforces that analysts should 'run and observe' code as a norm, again without any safety disclosure or containment requirements. Because this appears as prescriptive best practice, it materially increases the likelihood that users will execute potentially hostile code during routine analysis, amplifying the risk of compromise.
No suspicious patterns detected.
