Security audit
Security checks for vulnerabilities and agentic risk
This markdown-only audit evidence skill is purpose-aligned, but users should handle the collected evidence as sensitive security and identity data.
Install only if you intend to collect formal audit evidence. Run commands with least-privilege read-only accounts, review each command before execution, store outputs in an encrypted access-controlled evidence location rather than a general repository, redact unnecessary personal or security-sensitive fields before sharing, and define retention and deletion for the evidence package.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
gcloud monitoring policies list --format=json
# Cloud KMS keys
gcloud kms keys list --location=global --keyring={keyring} --format=json
# VPC networks
gcloud compute networks list --format=json
The skill asserts that no scripts are executed and that it is only markdown guidance, yet it includes concrete shell commands and a loop intended to be run against live services. This mismatch can cause an agent or operator to underestimate operational risk, trust the skill too much, and execute commands that access sensitive environments without appropriate review.
The command set exports highly sensitive audit material locally, including IAM policies, audit logs, security alerts, admin roles, device inventories, and user MFA status, without prominent handling guidance. If these outputs are stored insecurely, committed to version control, shared broadly, or left unencrypted on endpoints, they can materially increase the attack surface and expose privileged configuration and identity data.
This file provides a large set of commands that enumerate organization members, admins, audit logs, secret-scanning alerts, IAM policies, access assignments, OAuth tokens, and device/user data, but it does not warn that the outputs contain sensitive security and personal information. In an audit-evidence collection skill, this increases the chance that operators will export, store, or share high-value data without minimization, redaction, approval, or secure handling controls.
This document instructs collection of many evidence artifacts that commonly contain highly sensitive data, including user access lists, privileged accounts, HR records, incident communications, vendor contracts, and security configurations, but it provides no handling, minimization, redaction, storage, or access-control guidance. In an audit-evidence collection skill, that omission is dangerous because users may export and aggregate confidential or personal data into broad evidence packages, increasing the risk of over-collection, unauthorized disclosure, and noncompliant handling during audits.
L028 states 'Evidence stays local — all outputs go to the local filesystem,' which suggests a purely local data flow, but the bulk of the skill gathers evidence by querying remote services such as GitHub, GCP, Azure, and Google Workspace. While outputs are saved locally, the statement contradicts the actual collection behavior if read as describing where evidence processing occurs.
No suspicious patterns detected.