Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent design-review skill, but it tells agents to auto-publish creative work and set recurring/persistent creative workflows without clear user approval or scope.
Install only if you want an agent to help evaluate visual creative and maintain creative reference materials. Before using it in a live brand or social workflow, require explicit approval for every publish action, define where files may be written, and avoid enabling recurring tasks or agent-personality updates unless you intentionally want that persistent behavior.
The workflow explicitly recommends auto-publishing content once internal checks pass, which authorizes an externally impactful action without a mandatory human approval step. Even in a benign creative skill, automated publication can cause brand damage, accidental policy/legal violations, or release of incorrect/off-brand material at scale if the agent misjudges quality or context.
The manifest says to use the skill when creating 'any visual content' and lists generic triggers like 'review this design' and 'design feedback.' These phrases are broad enough to overlap with ordinary conversation and there are no exclusion conditions or negative examples to clarify when the skill should not activate.
The skill repeatedly instructs the agent to create logs, folders, style guides, anti-pattern files, and other workspace artifacts without requiring user confirmation first. In an agent environment, silent filesystem writes can modify repositories, leak sensitive contextual material into persistent files, or create unexpected side effects the user did not authorize.
No suspicious patterns detected.
