Security audit
Security checks for vulnerabilities and agentic risk
This skill is purpose-aligned as a business validation tool, but its artifacts overstate security-critical validation capabilities that the included implementation does not provide.
Review this carefully before installing as a production gate. It may be useful for content checks, but do not rely on it for price validation, risk-metric enforcement, blocking, or alerting unless those paths are implemented and tested in your environment. Treat violation logs as potentially sensitive tenant/business data.
The skill claims to be a 'last line of defense' for compliance, pricing, and risk-threshold validation, but the finding indicates those controls are not actually implemented. In a security/compliance control, this creates a dangerous false sense of enforcement: operators may rely on the skill to block risky content or pricing when it does not, allowing violations to pass into production unchecked.
The script’s advertised scope includes price validation and risk-metric threshold checks, but the implementation only supports content-text validation. In a security/control pipeline, this creates a dangerous coverage gap: callers may believe high-risk price or metrics workflows are being enforced when they are silently unvalidated, enabling policy bypass and unsafe publication or pricing decisions.
The usage examples instruct operators and upstream agents to use --price and --metrics modes that do not exist in the CLI parser. This mismatch can cause security-relevant automation to assume validations are occurring when the script actually fails or only checks content, resulting in skipped controls and false assurance around pricing and risk-threshold enforcement.
The skill documents persisting violation logs to disk with tenant IDs, timestamps, and violation details, but does not clearly warn users about retention, sensitivity, access controls, or redaction. In a multi-tenant compliance context, these logs can expose sensitive business data, content snippets, or tenant activity history if stored insecurely or retained too long.
No suspicious patterns detected.
