Security audit
Security checks for vulnerabilities and agentic risk
This skill is not clearly malicious, but it mixes production deployment automation with vague generic data-processing automation while requesting command execution authority.
Review this skill carefully before installing. Use it only if you are comfortable with a deployment assistant that can run commands, and require explicit human approval, environment selection, and dry-run/read-only checks before any action touching production, CI/CD, cloud resources, credentials, or rollback/deployment state.
The skill documentation presents two materially different purposes: production launch/deployment assistance and generic data-processing automation. This ambiguity can cause the agent or user to invoke a skill with exec privileges under the wrong assumptions, increasing the chance of unsafe or unintended operational actions in a production context.
The file claims sensitive operational capabilities such as rollback, deployment automation, and cross-region deployment, but its formal interface only describes generic content processing. This mismatch is dangerous because it obscures what actions may actually be taken, making it easier for a user or agent to trigger deployment-affecting behavior without clear, explicit contract or review.
The activation criteria are overly broad and vague, covering generic automation, data analysis, and workflow orchestration without strong boundaries. In combination with the presence of exec, this can cause over-triggering in unrelated contexts and elevate the risk of unintended command execution or production-impacting actions.
The skill advertises automation in a production-launch context and declares exec as an available tool, yet it omits a clear warning that commands may be executed and that deployment-related actions can affect live systems. This lack of disclosure weakens informed consent and increases the chance of accidental destructive changes in production or release pipelines.
No suspicious patterns detected.
