Security audit
Security checks for vulnerabilities and agentic risk
The skill is a code-analysis helper, but it asks for broad agent powers while mixing local analysis, automatic history storage, callbacks, and external API use without clear boundaries.
Review this before installing in repositories with proprietary code or secrets. Use it only when you explicitly want repository analysis, keep network/API and callback features disabled unless needed, verify destination URLs and environment variables, and periodically purge .code-analyze history if reports may contain sensitive content.
The documentation gives conflicting statements about whether the skill works offline, whether it needs network access, and whether an API key is required. In a skill with Bash/Write/Edit capabilities, this ambiguity can cause operators or downstream agents to make unsafe assumptions and unintentionally transmit code or secrets to external services.
The Q&A instructs users to configure environment variables and API keys even though earlier sections say no extra API key is needed. This inconsistency can lead users to provision credentials unnecessarily or expose secrets in environments where they believed the tool was purely local.
The activation description is extremely broad, covering generic coding, debugging, testing, and deployment scenarios rather than a narrowly scoped analysis function. Overbroad triggers increase the chance that an agent invokes a powerful skill in unrelated contexts, expanding access to Read/Write/Edit/Bash beyond user intent.
The supported-keyword list is excessively broad and ambiguous, making activation boundaries unclear. In agent systems, fuzzy routing can cause this skill to intercept benign requests and perform unintended file access, command execution, or archival behaviors.
The skill describes automatic archival and trend tracking of analysis history without a prominent consent and retention warning. Because analyzed content may include proprietary code, secrets, or sensitive findings, silent local persistence increases confidentiality and compliance risk.
The skill supports callback URLs and external API/webhook usage without a prominent warning that analysis inputs and results may leave the local system. For a code-analysis skill, this is especially risky because source code, vulnerability details, and embedded secrets could be exfiltrated to third-party endpoints.
No suspicious patterns detected.
