Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local book-notes tracker whose file access is limited to creating and reading note files for its stated purpose.
Install this only if you are comfortable with an agent writing and reading a local books directory for notes, quotes, metadata, and reading-list state. Use a dedicated notes folder or configure booksDir explicitly so it does not mix with unrelated files.
The documented behavior materially understates the skill's capabilities by presenting it as a simple note-taking tool while it also implies local filesystem writes and directory/file discovery. That mismatch is dangerous because users and orchestrators may grant trust or permissions based on the declared purpose, leading to unexpected access to local data and broader side effects than anticipated.
The skill is described with broad conversational phrasing such as 'just talk about what you read,' without clear trigger boundaries or explicit operation constraints. In an agent environment, ambiguous activation can cause the skill to engage unexpectedly on ordinary conversation and write or organize content without deliberate user intent.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
No suspicious patterns detected.