Security audit
Security checks for vulnerabilities and agentic risk
The skill is a cloud-storage manager, but it asks for powerful cloud/file execution capabilities while mixing in unrelated generic data-analysis and LLM-review instructions and under-scoped destructive operations.
Review this skill carefully before installing. It may be useful for cloud-storage administration, but only use it with accounts and folders you intend it to manage, avoid giving it broad local directories or reusable API keys, and require manual confirmation before deleting files, cleaning version history, changing permissions, or creating scheduled backup rules.
The invocation guidance says to use the skill for broad data analysis, reporting, statistics, and visualization tasks, which is far wider than cloud-storage management. Overbroad routing increases the chance that unrelated sensitive data gets sent into a skill with read/exec capabilities, enabling unintended command execution paths or misuse of local and cloud resources.
The skill advertises version-history comparison and deduplication, while later FAQ text states version-history cleanup is physically irreversible. Without prominent safety guardrails near the feature description and usage flow, users or agents may trigger destructive operations without understanding that recovery is impossible.
The skill is presented as a cloud-storage management tool, but later sections redefine inputs/outputs around a generic LLM review-and-scoring workflow. This mismatch can cause the agent to invoke the skill in unintended contexts and mishandle user data, especially because the skill also declares exec capability and broad automation behavior.
The file correctly warns against hardcoded secrets, but then introduces a generic API_KEY export unrelated to the cloud-manager's stated function. This can confuse operators into provisioning unnecessary credentials, increase secret exposure in shells/logs, and widen the attack surface without a justified cloud-storage use case.
