Security audit
Security checks for vulnerabilities and agentic risk
The skill is not malicious, but it asks for command-execution authority while describing a broad, loosely scoped automation role with weak user-control guidance.
Review this skill carefully before installing. It appears to be a generic developer automation prompt rather than a tightly scoped incremental-implementation helper, and it may lead an agent to run commands or handle credentials in situations where you expected a narrower workflow. Use it only in trusted repositories and require explicit confirmation before shell commands, credential setup, privileged execution, or file-changing operations.
The activation language is extremely broad, such as using the skill whenever efficiency, automation, batch processing, or workflow optimization is desired. Overbroad triggers can cause the agent to select this skill for many ordinary requests, exposing users to unnecessary file, API, or execution capabilities outside a tightly scoped use case.
The skill markets itself as an incremental multi-file implementation helper, but the body broadens into generic automation, data processing, API use, and command execution. This mismatch can cause the agent or user to invoke the skill in contexts far beyond its stated purpose, weakening trust boundaries and increasing the chance of unsafe actions under an implementation-themed label.
The documentation for an implementation-focused skill includes command execution, file handling, API credential setup, and operational troubleshooting without a clear need-to-use justification or restrictions. In an agent ecosystem, this can normalize shell execution and system modification under a vague feature banner, creating a pathway to unintended or risky actions.
The skill describes API key configuration, file preparation, processing, command execution, and environment checks, but does not pair these actions with prominent warnings about system impact, credential exposure, destructive changes, or approval requirements. In practice, this lowers operator caution around sensitive actions and can lead to unauthorized modifications or secret mishandling.
No suspicious patterns detected.
