Security audit
Security checks for vulnerabilities and agentic risk
The skill coherently documents auditing and reversible cleanup of installed skills, though its external npm implementation remains unverified.
Start with check or plan, review fix --dry-run before applying changes, and confirm which skills will be archived or hidden. Prefer a reviewed, pinned package version. Optional MCP installation changes persistent configuration; this review covers the supplied instructions, not the npm package's executable behavior.
The dry-run command aligns with auditing and planning, but the two subsequent fix commands apply changes. Reversibly archiving skills and changing their automatic-invocation behavior are material write capabilities not disclosed by the audit-and-plan description. The supplied chunk also does not visibly produce token-cost measurements.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The doctor command executes an npm package without an exact version, allowing the resolved code to change over time. A compromised release could execute with the agent's filesystem and network permissions; -y removes the package-install confirmation prompt.
The check command executes an unpinned npm package with automatic installation approval. Describing the intended check as read-only does not constrain a compromised package, which could access sensitive files or modify the environment.
Although plan is intended to produce recommendations, it still executes code from an unpinned npm package. A compromised resolved release could perform arbitrary actions with the agent's permissions instead of merely reporting a plan.
The scan command uses an unpinned package, so the executable code is not fixed by the skill documentation. A compromised release could misuse the filesystem access granted for scanning or exfiltrate accessible data.
The dry-run command executes an unpinned package before any dry-run behavior can be trusted. A compromised release need not honor --dry-run, so this flag does not provide a security boundary.
The fix command executes an unpinned package in a workflow that intentionally permits skill-file changes. A compromised release could abuse that write access, and a preceding dry run could resolve different package code if the release changes between invocations.
The fix --hide command uses an unpinned npm package while granting it access to modify skill behavior. A compromised release could make unrelated configuration changes or execute other actions with the agent's permissions.
The documented MCP installation command executes an unpinned npm package with automatic installation approval. A compromised release could abuse installation privileges; the supplied file does not establish whether the resulting MCP registration pins its runtime version.
