Security audit
Security checks for vulnerabilities and agentic risk
This is a local commute-emissions calculator that clearly documents its trip logging and CSV export behavior, with no evidence of hidden network access, credential use, or unsafe persistence.
Before installing, be aware that trip dates, modes, distances, passengers, notes, and exports are stored locally in files you or the tool choose. Use it for personal planning and comparisons, not certified reporting, regulatory accounting, or offset purchases.
The skill advertises persistent logging to ~/.commute-carbon.json and CSV export, which implies file write capability, but the manifest does not declare any permissions or allowed-tools scope. That creates a mismatch between documented behavior and declared access, weakening least-privilege guarantees and making it harder for a host system or reviewer to constrain where data may be written.
The description says to use the skill when the user wants to know the carbon footprint of daily commute or travel habits, is deciding between commuting modes, tracking a personal emissions goal, or preparing an environmental impact report. These triggers are broad natural-language situations rather than a narrow command scope, which could cause unintended invocation for general sustainability or reporting conversations.
