Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed technical-specification writing skill with optional local template scripts, and I did not find hidden, destructive, or credential-stealing behavior.
Before installing, be aware that this skill may auto-activate on broad architecture or implementation-design requests, and its optional helper scripts can read a PRD path you provide and write a Markdown output file you choose. Do not expect the --prd script to fully generate a finished spec by itself.
If the included scripts primarily validate skill structure or inspect local package contents rather than transform PRDs into technical specifications, the skill is behaviorally misleading. In agent environments, this can bypass user expectations and policy review, because a seemingly harmless design assistant can operate as a filesystem-inspecting utility without clear authorization.
If the included scripts primarily validate skill structure or inspect local package contents rather than transform PRDs into technical specifications, the skill is behaviorally misleading. In agent environments, this can bypass user expectations and policy review, because a seemingly harmless design assistant can operate as a filesystem-inspecting utility without clear authorization.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
| Term | Description |
|------|-------------|
| AccessToken | Access token, valid for 1 hour, used for API authentication |
| RefreshToken | Refresh token, valid for 7 days, used to obtain new AccessToken |
| bcrypt | Adaptive password hashing function |
The skill advertises scripts and manual installation paths that imply filesystem read/write capability, but the manifest declares no explicit tool scope or permissions. In an agent ecosystem, undeclared capabilities reduce transparency and can cause the host to grant broader access than users expect, increasing the chance of unintended file access or output creation.
The auto-trigger rules are broad enough to match many ordinary implementation or design questions, causing the skill to activate in situations beyond its narrow intended use. Overbroad triggering is risky because it increases the chance that a misleading or overprivileged skill runs on unrelated user requests, especially when the skill also references local scripts and file operations.
For a skill whose stated purpose is turning requirements/PRDs into structured technical specs, the --prd mode is a core behavior. In this file, that mode does not perform transformation into a specification; it merely echoes guidance and the first 500 characters of the PRD, which is materially narrower than the manifest's described capability.
The function is named and exposed via CLI help as generate_from_prd, which implies converting PRD content into a generated technical spec. However, the implementation reads the PRD and returns a placeholder instruction block telling the user to analyze it manually, contradicting the documented behavior of automatic generation.
The comment and required section list explicitly require English headings such as '# Overview' and '## Usage'. This is a natural-language locale policy constraint embedded in code, and the file does not provide any user opt-in or region-specific justification for enforcing English.
The build dependency is specified as setuptools>=61.0 without an upper bound or exact pin, so the actual installed version is environment-dependent and could resolve to a release with known vulnerabilities. While this file does not itself exploit anything, leaving a security-sensitive packaging dependency unpinned increases supply-chain risk and makes it difficult to verify whether vulnerable versions are excluded.
No suspicious patterns detected.