Security audit
Security checks for vulnerabilities and agentic risk
This data-analysis skill is not malicious, but it asks for broad command and file access while making security-control claims that are not backed by the artifact.
Install only if you are comfortable reviewing each proposed file access, file write, and command before it runs. Do not rely on the skill's encryption, access-control, or command-whitelist claims unless the publisher provides an actual implementation or deployment documentation for those controls.
The skill claims encrypted transmission and encrypted storage as established security properties, but the file provides no implementation, configuration, or enforceable mechanism demonstrating those controls. This can mislead users into sending sensitive data under false assumptions, increasing the risk of data exposure or noncompliant handling.
The documentation asserts that only whitelisted commands are executed, yet the skill exposes exec capability and contains no visible whitelist policy, validation logic, or execution constraints. In a skill with command execution privileges, this creates a dangerous mismatch that may cause operators to trust a control that does not actually exist, raising the risk of arbitrary command execution or unsafe use of user-controlled input.
The activation/usage description is extremely broad, covering general data analysis, reporting, insights, and visualization across many scenarios. Because the skill also advertises read, write, and exec tools, overly generic triggering can cause the agent to invoke powerful capabilities in situations where a narrower, safer skill or a simple textual response would suffice.
The skill exposes read, exec, write, and glob capabilities up front, but the documentation does not prominently warn users that invoking the skill may run commands or modify files. In practice, this reduces informed consent and can lead to accidental destructive actions, data leakage, or system changes when users believe they are only requesting analysis.
