Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent research-report helper that reads user-provided material, researches related teams, and returns a DOCX report to the user.
Before installing, users should understand that this skill may read the documents or links they provide, perform web research, create a DOCX report in the workspace, and return that file. Avoid providing confidential material unless that workflow is acceptable.
The skill instructs reading local files, fetching URLs, searching the web, and generating/transmitting output, but it declares no explicit tool scope or permissions. Without least-privilege boundaries, an agent may invoke broader file or network capabilities than intended, increasing the risk of unauthorized data access or unexpected side effects when handling adversarial inputs.
The workflow explicitly saves a generated DOCX to the workspace and sends it to the user, but the skill description does not clearly disclose that it creates and transmits a file derived from potentially sensitive analyzed content. This weakens user awareness and consent, and in a research-analysis context could lead to unintended exfiltration or sharing of personal, proprietary, or confidential material.
The checklist explicitly requires the report to be formatted in Markdown, which is a natural-language/output-format constraint stated as mandatory guidance. Because the document does not present this as an optional format or offer alternatives, it can be read as forcing a specific output convention without user opt-in.
No suspicious patterns detected.
