Security audit
Security checks for vulnerabilities and agentic risk
This Markdown-only coding workflow skill is not clearly malicious, but its broad file/shell authority is undercut by contradictory claims about local-only behavior, network/API use, and API keys.
Review before installing. This skill appears to be a workflow prompt rather than bundled malware, but install it only if you are comfortable granting file editing and shell execution to a broadly triggered coding assistant. Treat its local-only and no-network claims cautiously, and do not provide API keys or credentials unless a specific task clearly requires them and the destination is explicit.
The privacy/security section says the tool makes no network requests, but other sections describe API integration, network diagnostics, and TLS-secured communication. This inconsistency is dangerous because it obscures data egress risk and may cause users to expose source code, logs, or credentials to external services they were told would not be contacted.
The skill is presented as a local structured development workflow tool, but the description also implies external API integration and network-enabled behavior. This mismatch broadens the apparent trust boundary and can cause users to invoke a capability set that is materially more powerful than the stated purpose.
The activation description is overly broad, effectively matching many generic coding scenarios. Broad triggers increase the likelihood that the skill activates in contexts where its file, shell, memory, or network-related guidance is unnecessary, causing privilege overreach and unexpected behavior.
The skill imposes a Python/PEP 8/pytest preference without explicit user opt-in. This is mainly a policy and autonomy issue rather than a direct exploit path, but it can steer code generation and edits in unintended ways and reduce trust in the tool's behavior.
The skill claims it does not automatically execute code, yet later describes automated execution of commands and workflows. This contradiction can mislead users and host agents about the tool's real behavior, increasing the chance that command execution is enabled under false safety assumptions.
The document promises file-access limits to $HOME/code and the project, but the skill is granted broad Read/Write/Edit/Bash capabilities without any enforceable mechanism in the skill text. Users may rely on the stated boundary even though the agent could still access or modify arbitrary files if prompted or misdirected.
API key setup and external service connectivity are not justified by the stated purpose of a personal structured coding workflow tool. Requesting credentials for unrelated or weakly related features increases credential exposure risk and can be abused to normalize unnecessary secret handling.
Network troubleshooting instructions such as ping tests are inconsistent with a tool described as fully local workflow management. While not directly malicious, such guidance can expand operational behavior beyond user expectations and encourage unnecessary network interaction in a higher-trust local tool context.
No suspicious patterns detected.
