Security audit
Security checks for vulnerabilities and agentic risk
This code-audit skill is mostly purpose-aligned, but it asks for powerful read, write, edit, command, and integration capabilities with broad activation language and limited user-control guidance.
Install only if you want an agent to run code-audit commands over your project and generate or edit files. Use it on trusted repositories, review commands before execution, keep external scanner settings disabled unless needed, and avoid broad automatic activation for normal coding tasks.
The skill claims that user input is not concatenated into commands, but its example workflow passes a user-controlled project path into command-driven processing. Even though the sample uses quoting, this still encourages execution over attacker-selected filesystem targets and creates a misleading security guarantee that may cause downstream unsafe implementations.
The trigger condition is so broad that the skill could activate for routine development, debugging, or deployment tasks unrelated to secure auditing. In a skill with Read/Write/Edit/Bash capabilities, overbroad triggering raises the chance of unnecessary command execution, file modification, or collection of sensitive project data without clear user intent.
The skill advertises file writing, command execution, and API integration, but does not provide prominent user-facing warnings about side effects such as filesystem changes, report generation, network calls, or disclosure of code metadata to third parties. In a powerful agent context, missing warnings can lead to unintended system impact and unsafe operator trust.
No suspicious patterns detected.
