Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple report-writing aid for nonprofit impact reports and does not show hidden, destructive, or credential-seeking behavior.
Before installing, understand that this skill may be invoked for nonprofit reporting tasks and may use presentation or image-generation features to create report assets. Review generated reports before publishing, especially if they include financial, donor, beneficiary, or program-impact claims.
The skill description is broad enough that it could be invoked by ordinary reporting-related requests without clear scoping or trigger boundaries. This can cause unintended activation, leading the agent to use presentation and image-generation capabilities in contexts where the user did not explicitly request this skill, though the content itself does not appear malicious.
The suggested prompt, 'for my nonprofit business,' is highly generic and closely resembles normal user phrasing, increasing the chance of accidental or overly broad invocation. In an agent environment, ambiguous trigger text can route routine reporting requests into this skill without sufficient user intent confirmation.
No suspicious patterns detected.
