Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Review item because a supposed API reference asks for read and command-execution authority while describing broad automation, file handling, credentials, and command execution without clear limits.
Install only if you intentionally want a broad automation-oriented skill with read and command-execution access. For a normal Claude/API reference need, this artifact is over-scoped and under-specified; review command use, credential handling, file access, and any administrator-run suggestions before enabling it.
Introducing command execution in a skill whose stated purpose is an API/SDK reference materially raises risk because command execution can affect the host system, files, credentials, and network state. Without strong justification and upfront safety constraints, this creates a path for unintended or socially engineered system-impacting actions.
The trigger text is broad and ambiguous, covering development automation, data analysis, and orchestration with little constraint. Overly permissive trigger language increases the likelihood that an agent selects this skill in inappropriate contexts, where its overstated capabilities could drive unsafe or unnecessary actions.
The skill presents itself as API/SDK reference material but advertises broad automation capabilities such as workflow orchestration, bulk processing, recovery logic, and system interaction. This scope inflation is dangerous because downstream agents may over-trust the skill and use it for actions beyond documentation lookup, increasing the chance of unauthorized or unsafe behavior.
The manifest frames this as a read-before-use reference skill, but the body repeatedly claims active processing, retries, batching, file handling, and execution behavior. That mismatch can mislead an agent or user into invoking the skill in higher-risk operational contexts than intended, expanding effective authority and enabling unsafe automation through deceptive documentation.
The documentation claims file processing and output generation capabilities even though the skill is positioned as a reference guide. File handling changes the risk profile because it can lead agents to read, write, or transform local data under false assumptions about the skill’s intended authority.
The skill references API key setup, API calls, file preparation, and command execution steps without a prominent upfront warning that these actions may have system, data, or credential impact. This omission is dangerous because users or agents may proceed without understanding that secrets, local files, or host state could be affected.
No suspicious patterns detected.
