Security audit
Security checks for vulnerabilities and agentic risk
This UX skill is mostly documentation-only, but it asks for broad file, command, and external-service capabilities that are not clearly scoped to UX work.
Review this skill carefully before installing. It may be useful for UX analysis, but only enable it in an environment where you are comfortable with file access and potential command execution, and require clear confirmation before it modifies files, runs shell commands, or sends content to external services.
The skill is presented as a UX design/analysis tool, but it also advertises generic command execution. That capability is unrelated to the stated purpose and materially expands the attack surface, since a user may invoke or permit shell actions without understanding that the skill can affect the host environment.
The documentation claims a UX-focused purpose while also advertising external API integration. This mismatch can hide unexpected data flows, where user content or local data may be transmitted to third-party services beyond what a UX analysis skill would reasonably require.
The skill advertises read, write, exec, and API-related capabilities without clear, prominent warnings about host impact, data modification, or external transmission. In an agent context, that omission is dangerous because users may treat the skill as a harmless UX helper while it can alter files, run commands, or send data off-system.
No suspicious patterns detected.
