Security audit
Security checks for vulnerabilities and agentic risk
This skill is a transparent tool-efficiency guide with a local log analyzer and no hidden execution, persistence, or data exfiltration behavior found.
Install this if you want agent behavior guidance around fewer, more deliberate tool calls. Review the guidance if your workflows require strict verification after edits, because some advice favors caching and avoiding re-reads for efficiency; keep normal safety checks for high-impact changes.
The skill discusses and encourages file-reading behavior (read_file) but does not declare any explicit tool scope such as permissions or allowed-tools. In agent ecosystems, missing scope declarations can cause overbroad default tool access or make review and enforcement harder, increasing the chance that an agent uses file-read capabilities outside the author’s intended boundaries.
The skill claims to teach agents to avoid redundant reads, batch independent calls, and cache results within a session. The sample repeatedly reads src/main.py and repeats the same search_files query for def , while also using separate single-call turns rather than batching independent reads, which conflicts with the stated behavior.
The manifest describes a skill about minimizing tool-call overhead through batching, caching, and budgeting. This sample session demonstrates unrelated operational behavior—editing source code with patch and executing tests via terminal—which goes beyond illustrating tool-economy techniques.
The sample normalizes shell-based tools (cat, grep, and especially a generic terminal command running python3 -m pytest) in a skill whose stated purpose is only to reduce tool-call overhead. This is dangerous because it can implicitly encourage agents to prefer unrestricted shell execution as a 'single powerful command,' expanding capability beyond the intended scope and increasing the risk of arbitrary command execution if similar patterns are generalized.
No suspicious patterns detected.
