Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local furniture assembly helper with some overstated capability claims, but no evidence of hidden access, exfiltration, destructive behavior, or unsafe persistence.
Install only if you are comfortable with a simple local helper, not a true photo or diagram interpreter. Expect it to store assembly progress in a JSON file under your home directory, and verify any safety-critical assembly steps against the manufacturer's manual.
This finding indicates the skill claims dynamic assembly assistance capabilities that are not actually present, offering only static predefined guidance. While this is less severe than direct code execution or exfiltration, misleading capability claims can cause unsafe reliance, poor oversight, and incorrect expectations about what data is processed or what safeguards exist.
This finding indicates the skill claims dynamic assembly assistance capabilities that are not actually present, offering only static predefined guidance. While this is less severe than direct code execution or exfiltration, misleading capability claims can cause unsafe reliance, poor oversight, and incorrect expectations about what data is processed or what safeguards exist.
The skill advertises code-backed components and detected file read/write capabilities, but it does not declare any tool scope or permissions boundary. Undeclared filesystem access can lead to unexpected local file access or persistence, and prevents reviewers and users from understanding what the skill is allowed to do.
The skill metadata and docstring advertise diagram/photo-based instruction reading and guidance, but the implementation is only a local CLI that accepts manual step and parts input and stores state in a JSON file. This mismatch can mislead users or downstream agents into trusting capabilities that do not exist, causing unsafe reliance during physical assembly and potentially leading to incorrect instructions, missed verification, or improper use in automated workflows.
The manifest describes a skill that can decode visual assembly instructions, manage parts inventory, track assembly progress, and identify the current step from a photo. In this file, the implemented behavior is limited to printing hardcoded guidance and warnings for known step types and projects via command-line arguments, with no diagram analysis, photo handling, inventory logic, or progress state management.
No suspicious patterns detected.
