Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward agent-config synchronization helper that can change multiple project config files, but that behavior is disclosed and aligned with its purpose.
Before installing or using it, expect it to read and potentially update AI-agent rule files in the current project. Review the displayed diffs carefully before accepting changes, because these files can influence future agent behavior across several tools.
The top-level description advertises easy syncing across many agents but does not warn that the action may write to multiple configuration files across the repository. This can mislead users about the operation's side effects, increasing the risk of accidental bulk modification, config drift introduction, or unintended overwrites.
The trigger phrase "sync my agent configs" can cause broad file-writing behavior across multiple agent configuration files, but it does not clearly communicate scope, targets, or confirmation boundaries in the invocation itself. In a skill that performs multi-file sync operations, overly simple activation increases the chance of accidental execution or invocation in the wrong repository/context.
The phrase "check config drift" is ambiguous because it does not specify which configs, repository, or comparison baseline should be used. While this is primarily a read/report action, ambiguity can still lead to incorrect routing, unintended inspection of unrelated files, or misleading results in multi-project environments.
The phrase "create RULES.md" is concise but still ambiguous without surrounding constraints, because many repositories may use similarly named files or discuss creating files generally. The document does not specify required context or exclusions for when this command should map to this skill.
