Security audit
Security checks for vulnerabilities and agentic risk
This logo-design skill is not malicious, but it asks for broad command and file permissions with loose activation wording, so it should be reviewed before installation.
Install only if you are comfortable with a creative-design skill that can request command execution and file modification. Keep use limited to explicit logo/image tasks, review any proposed shell command, callback URL, API key use, or file write before allowing it, and prefer a narrowed version that removes generic exec permission or documents exact allowed operations.
The trigger keywords are extremely broad, including terms like automation, design, brand, image, machine learning, and natural language. This can cause the skill to activate in many unrelated contexts, increasing the chance that an agent routes prompts into a skill with exec/write capabilities unexpectedly and performs actions the user did not intend.
The skill declares read, exec, and write tool access, but the documentation does not clearly disclose the security implications or require explicit user consent before command execution or file modification. In combination with broad activation text, this creates a real risk of unexpected shell commands, network tests, or file changes being carried out under a seemingly harmless creative-design skill.
The capability coverage language is vague and expansive, using ambiguous phrases like applicable to enterprise teams and automation workflows without precise boundaries. In an agent environment, this can over-broaden routing and encourage use outside the intended logo-design context, which is riskier because the skill declares execution and file-writing tools.
The skill documentation describes the free edition as lacking batch generation capability, yet the example for startup-team brand validation tells the user to generate multiple directions and labels it as batch generation. While it qualifies this as manual execution, this still conflicts with the later statement that the free version has no batch generation capability.
No suspicious patterns detected.
