Security audit
Security checks for vulnerabilities and agentic risk
This skill is a WebSim API helper with mostly read-only, purpose-aligned behavior, but users should be careful with the comment-posting token and avoid exposing internal project reasoning fields.
Install only if you want an agent to query WebSim data and, when explicitly asked, post comments using a user-supplied WebSim token. Do not ask it to retrieve or repeat internal reasoning fields such as site.yapping unless you are sure that content is appropriate to disclose.
The skill explicitly documents site.yapping as "The AI's internal reasoning/thinking log" and presents it as a field to retrieve during project inspection. Exposing or encouraging access to internal reasoning can disclose sensitive implementation details, hidden prompts, secrets accidentally embedded in reasoning traces, or other non-user-facing data that should not be surfaced by default.
This markdown file describes a state-changing POST action that sends user-provided content and a Bearer token to an external service. While it says authentication is required and not to post autonomously, it does not explicitly disclose the privacy/security impact of transmitting the comment and token to WebSim.
