Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only skill openly teaches encrypted hidden emoji messaging and detection-avoidance tactics, so it should be reviewed before installation.
Install only if you have an authorized, legitimate need for hidden-message analysis or controlled watermarking. Treat it as a high-risk covert-communications tool: avoid using it to bypass monitoring or platform rules, review any commands before execution, limit file access to intended inputs/outputs, and understand that token verification, transport checks, reports, caches, and watermark libraries may create local or network-visible records.
The skill claims all encoding/decoding is local and implies message content is not sent externally, yet elsewhere documents network-dependent transport testing and token verification against external servers. This can mislead users about data exposure boundaries and create unsafe assumptions when handling sensitive or covert communications.
The documentation says no extra API keys are needed while also listing an LLM API dependency and external network-backed functions. Even if keys are platform-managed, this is still materially misleading because users may believe the skill is self-contained and offline-safe when it is not.
The documentation enables automatic watermark embedding and specifies a local library path without warning that user content may be modified or that watermark data may be written to disk. In an agent skill context, this can lead to silent alteration of user-generated content, privacy issues, and unexpected persistent file writes, especially if users assume the tool is read-only or transformation-only.
The skill presents a structured covert-communication workflow centered on hiding, encrypting, transmitting, validating, and tracing secret messages. In context, this is not a neutral encoding utility; it operationalizes clandestine communication and lowers the barrier to abuse for evasion of monitoring or policy controls.
The custom encoding section explicitly advertises anti-detection and high-concealment scenarios through alternate mappings and multilayer encoding. That is directly useful for evading inspection and detection systems, making the skill materially more dangerous than a generic text encoding tool.
The carrier-selection strategy is designed to make hidden messages blend into normal conversation and resist pattern/statistical analysis. This is explicit evasion guidance that improves stealth and detection resistance, increasing the offensive utility of the skill.
The documented workflow gives a practical recipe for covertly preparing, encoding, encrypting, transmitting, and auditing sensitive messages across compatible channels. Stepwise operational guidance meaningfully facilitates misuse by helping users deploy hidden communications reliably and at scale.
Repeated claims that custom encoding and auto-selection help avoid detection and avoid attracting attention reinforce an evasion-focused use case. Even as documentation, this normalizes stealth behavior and teaches users how to improve clandestine communications.
No suspicious patterns detected.
