Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple planning checklist with no code or privileged behavior, though its API-contract branding is broader than the actual guidance provided.
Install only if you want a generic risk-first planning checklist. Do not rely on it as a real API contract compatibility guard unless it is updated with schema-diffing, versioning, consumer-impact, and contract-test guidance.
The manifest and title present the skill as an API contract and backward-compatibility guard, but the body only describes a generic planning workflow. This mismatch can cause incorrect skill selection and misplaced trust, leading users or orchestration systems to rely on it for compatibility-sensitive tasks without any actual contract-validation logic or safeguards.
The activation description is broad enough to match many ordinary development requests, not just API contract work. Over-broad triggering increases the chance that this mislabeled skill is auto-selected in unrelated or sensitive workflows, where its generic guidance may override or displace more appropriate, specialized controls.
The skill branding strongly implies specialized API contract guarding, but the documented workflow contradicts that expectation by offering only a generic execution playbook. In practice, this semantic deception can bypass user scrutiny and workflow routing controls, causing the skill to be invoked in high-trust contexts where contract-specific analysis is required but absent.
The example prompts are generic planning requests and reinforce broad activation outside the claimed API-contract domain. This makes accidental or inappropriate invocation more likely, especially in systems that use examples as routing signals, and amplifies the risk created by the skill's misleading specialized branding.
No suspicious patterns detected.
