Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly writes local project files, but its final delivery script claims objective score-based selection while always choosing Agent A.
Review this skill carefully before installing if you need trustworthy automated selection. It does not show evidence of credential theft, persistence, or system compromise, but its core claim of objective winner selection is not implemented as advertised and may produce misleading final reports.
The script claims to perform objective, score-based winner selection, but it actually hardcodes winner="a". In a competitive or compliance-sensitive workflow, this silently subverts the documented decision process, enabling misleading provenance, biased delivery, and false audit artifacts that may be trusted by downstream users.
This shell script creates directories and writes markdown files under the workspace using mkdir -p and shell redirection, but it provides no advance user disclosure that it will modify the filesystem. The status messages only appear after execution has begun and do not function as a warning or confirmation before the write operations.
No suspicious patterns detected.
