Security audit
Security checks for vulnerabilities and agentic risk
This skill is not clearly malicious, but it asks an agent for broad file and command authority to install or alter SkillHub UI behavior while giving inconsistent and incomplete instructions.
Review this skill carefully before installing. Only use it in a disposable or version-controlled SkillHub environment, require the agent to show exact files and commands before any change, and do not provide API keys or credentials unless the missing installation materials and data flows are supplied and reviewed.
The skill claims installation must be manual, yet elsewhere instructs an agent to read and execute installation steps automatically. This contradiction weakens operator expectations and can lead an agent to perform file or system modifications without an explicit, scoped approval boundary, increasing the risk of unintended or unsafe changes during installation.
The skill metadata advertises read, write, and exec capabilities, but later describes itself as pure Markdown guidance. This misrepresentation can cause users or supervising systems to underestimate the skill's ability to modify files or run commands, which is dangerous because the actual capability set includes impactful operations.
The description is overly broad and muddled, mixing plugin architecture, UI design, branding, automation, and generic workflow claims without clear task boundaries. Ambiguous invocation criteria increase the chance that an agent applies the skill in inappropriate contexts and then uses its read/write/exec capabilities beyond what the user expected.
The usage example tells the agent to use the skill for a vaguely described 'task' without constraining what actions are allowed. In a skill that exposes file and command operations, this creates prompt-level overbreadth that could authorize unintended system changes, broad file access, or misuse of plugin installation behavior.
The skill explicitly advertises file handling, API integration, and command execution, but does not present clear, prominent warnings about the resulting data, credential, and system impact. In context, this is more dangerous because the skill is framed as a generic automation/UI helper, making high-impact behaviors easy to invoke without informed consent or safeguards.
No suspicious patterns detected.
