Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local absence-coverage planner whose file reads and writes are disclosed and aligned with its purpose.
Before installing, expect this skill to create and edit local coverage-planning files. Do not put passwords, keys, tokens, or sensitive credential values into duties.json, notes, runbooks, or generated checklists; use vault entry names or system names only. Store generated runbooks and checklists in an appropriate private workspace if they describe internal operations.
The skill documents CLI commands that read and write local files (team.json, duties.json, output checklists) but does not declare any permissions or allowed-tools scope. That creates a mismatch between stated and actual capabilities, which can lead to overbroad agent execution or unsafe deployment assumptions because users and orchestrators cannot constrain filesystem access explicitly.
The checklist command writes accumulated duty content, including free-form notes from duties.json, to a user-specified output file. Although the tool prints that it wrote the file, there is no prior warning that the generated file may contain sensitive operational details or should be handled carefully.
No suspicious patterns detected.
