Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed publishing workflow guide with broad deploy authority, but its behavior is coherent with its stated purpose.
Before installing, use this skill only when you are comfortable letting an agent run the documented build and deploy flow for the selected project. Confirm production targets, credentials, announcement channels, rollback commands, and any cron automation before allowing it to proceed.
The skill description is broadly phrased enough to invite invocation for almost any publishing or deployment task, including high-risk production changes. Because the skill is user-invocable and has exec/write capabilities, overly general activation language can cause an agent to apply it without sufficient scoping, safeguards, or human confirmation for sensitive release actions.
The "When to Use" section defines activation conditions very broadly, covering both routine recurring publishes and first-time deploys, which can include production-impacting operations. In a user-invocable skill with execution privileges, this increases the chance of the agent selecting the skill for sensitive deployments without enough context, approvals, or environment-specific safety checks.
No suspicious patterns detected.
