Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent pre-coding consultation workflow, with limited and purpose-aligned repository inspection and a design-document write that users should be aware of.
Before installing, expect the skill to inspect relevant repository context and create a design document in the project directory. Ask the agent to confirm the filename or show the design in chat first if you do not want new files added automatically.
The skill is presented as a pre-coding consultation tool, but it instructs the agent to write a design document into the project directory. That creates an unexpected side effect on the repository and can modify user files without explicit consent, which is risky for a supposedly advisory skill.
The skill directs the agent to write a design document into the project directory without warning the user that repository files will be modified. Silent workspace writes can overwrite intended workflows, create unwanted artifacts, or be abused to persist misleading content in the repo.
The manifest presents the skill primarily as a consultant for clarifying problems, users, risks, and metrics before implementation. The documented procedure additionally mandates reading local project docs, checking git history, and mapping codebase regions, which introduces repo-auditing behavior beyond the plain-language expectation of an Office Hours-style consultation.
No suspicious patterns detected.
