Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only coding workflow skill that encourages autonomous implementation but discloses its behavior and includes confirmation gates for destructive or unknowable decisions.
Install this if you want the agent to act more independently on coding tasks. Review its autonomy expectations first: it may create files, add routes, and extend logic without asking when it considers the work additive, while it should pause for destructive changes, credentials, business decisions, and major architectural choices.
The invocation guidance explains when to use the skill but not when to avoid it. Without explicit stop conditions, an agent may apply this autonomous workflow to ambiguous, high-risk, or policy-sensitive requests where human clarification should be mandatory.
The invocation guidance explains when to use the skill but not when to avoid it. Without explicit stop conditions, an agent may apply this autonomous workflow to ambiguous, high-risk, or policy-sensitive requests where human clarification should be mandatory.
The skill explicitly permits proceeding 'without asking' for a wide class of additive changes, including creating files, adding functions, routes, and extending logic. Even if framed as non-destructive, these autonomous changes can still introduce security flaws, alter behavior, or exceed user intent when performed without confirmation.
Before touching anything, classify every planned action as Additive or Destructive:
ADDITIVE (safe, proceed without asking):
- Creating new files
- Adding new functions, components, routes
- Extending existing logic with new branches
The instruction 'Never ask the user for order' reinforces a general norm of agent self-direction and minimizing clarification. In coding contexts, this can push the agent to make consequential sequencing and scope decisions on its own, which may mask uncertainty and lead to unauthorized or unsafe implementation choices.
Execute **every leaf node**. Stopping at 3 of 8 and reporting "done" is a failure.
**Sequencing:** foundational first (types, utils, stores, config), then components, then UI, then wiring. Never ask the user for order.
---
No suspicious patterns detected.