Security audit
Security checks for vulnerabilities and agentic risk
This audit skill is mostly purpose-aligned, but it combines broad file/command authority with continuous monitoring and external notification features that are not clearly scoped or disclosed.
Review this before installing if you work with private code, contracts, financial records, AI logs, or regulated data. Use it only with explicit audit targets, keep monitoring paths narrow, avoid configuring callback or Webhook URLs unless you know exactly what will be sent, and confirm any command execution or scheduled monitoring before allowing it to run.
The documentation says audit logs and evidence stay local and 'do not upload any data,' but elsewhere it supports webhook notifications and external service-style callbacks. That mismatch can mislead users into enabling features that transmit audit metadata or findings off-host without realizing it, creating confidentiality and compliance risk.
The activation language is very broad ('use when needing security detection, compliance audit, quality check, encryption protection'), which can cause the skill to trigger on generic requests and exercise powerful read/exec/write capabilities unexpectedly. Over-broad matching increases the chance of unintended execution in sensitive contexts and makes least-privilege routing harder.
The capability coverage section includes vague trigger keywords such as 'Use' and 'when', which are common words likely to appear in unrelated prompts. This can spuriously activate a high-privilege skill, increasing the risk of accidental tool use or inappropriate handling of user data.
The skill documents email and webhook notifications for monitoring alerts without clearly warning that audit information may be transmitted to external destinations. In a security-audit context, even alert payloads can contain sensitive paths, findings, or compliance details, so missing disclosure increases the risk of unintentional data exfiltration.
No suspicious patterns detected.
