Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown template pack for user-enabled heartbeat checks, with sensitive monitoring implications but no hidden execution, exfiltration, or destructive behavior found.
Before installing, only copy a heartbeat template into workspaces where periodic monitoring is intended, limit configured accounts and locations to what you actually want checked, and review what email/calendar details may be surfaced in heartbeat reports.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# HEARTBEAT CHECK
<!-- HEARTBEAT CONFIG -->
<!-- EMAIL_ACCOUNT: your@email.com -->
<!-- LOCATION: Denver, CO -->
<!-- QUIET_HOURS: 23:00-07:00 -->
The README states that after copying a template, 'Your agent picks it up automatically,' which encourages automatic activation of a heartbeat configuration without an explicit enablement or review step. In an agent skill context, background check-ins can access email, calendars, system health, or social data, so ambiguous auto-loading increases the risk of unintended execution and over-privileged monitoring.
The description markets the skill as usable for "common agent tasks" and says "Drop in and go," but it does not define any clear trigger scope, activation constraints, or exclusions. In a markdown skill description, this kind of broad natural-language framing can make it unclear when the skill should be selected versus more specific alternatives.
The listed templates cover email, calendar, weather/location, system health, social notifications, and project status, all of which can expose sensitive personal, organizational, or host-level data. Because the skill presents these templates as drop-in monitoring components without any warning about privacy, permissions, or least-privilege configuration, users may enable broad surveillance or over-collection unintentionally.
This markdown file describes checks that occur on 'Every Heartbeat' and '2x Daily' but never defines what event, command, or scheduler constitutes a heartbeat. Without explicit trigger phrases, context, or exclusion conditions, the skill could be invoked too broadly or at unintended times.
The skill directs an agent to monitor unread emails, sender identities, message subjects, and calendar events, all of which are privacy-sensitive, but it provides no explicit user-facing warning, consent flow, or data-handling limits. In an agent context, this can normalize silent background surveillance and lead to collection or disclosure of personal or work information without sufficiently informed authorization.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**USE AT YOUR OWN RISK.**
- The author(s) are NOT liable for any damages, losses, or consequences arising from
the use or misuse of this software — including but not limited to financial loss,
data loss, security breaches, business interruption, or any indirect/consequential damages.
- This software does NOT constitute financial, legal, trading, or professional advice.
- Users are solely responsible for evaluating whether this software is suitable for
No suspicious patterns detected.