Security audit
Security checks for vulnerabilities and agentic risk
This skill has a coherent body-scan purpose, but it asks agents to handle intimate body videos through a third-party bridge without clear retention details and declares broader command/file authority than the workflow needs.
Review this skill carefully before installing. Only use it if you are comfortable sending body-scan videos and measurements to the AnthroVision bridge, and confirm the bridge provider's retention, deletion, logging, and privacy practices first. The skill should not need shell command authority for the documented workflow, so prefer a version with exec removed and the unrelated security-audit claims cleaned up.
The documentation advertises unrelated capabilities such as CVE correlation, compliance auditing, and risk scoring that are not part of the stated Telegram body-scan workflow. This broadens the perceived authority of the skill, can mislead agents into invoking it in higher-risk security contexts, and may encourage over-privileged tool use inconsistent with the actual purpose.
The skill declares and normalizes command-execution concepts in troubleshooting and risk sections despite the body-scan use case not requiring shell access. In an agent environment where exec is available, this can justify unsafe command execution during error handling or diagnostics, increasing the risk of prompt-induced command abuse, data exposure, or local system interaction.
The skill lacks precise invocation boundaries, so an agent may apply it too broadly whenever body, video, Telegram, or measurement-related content appears. For a sensitive workflow involving biometric-like body measurements and consent checks, ambiguous triggering increases the chance of accidental activation, collection of sensitive data, or use outside intended restrictions such as non-medical or non-minor scenarios.
The skill processes highly sensitive body videos and derived measurements but does not clearly disclose retention, third-party processing, logging, or deletion behavior. Because this is intimate personal data, weak privacy notice and storage transparency can lead users to share material without understanding where it goes, how long it persists, or who can access it.
No suspicious patterns detected.
