Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for turning validated delivery lessons into reusable playbooks, with clear limits around evidence, authorization, and customer data.
Install only if you intend to process validated delivery evidence into reusable internal assets. Keep customer data de-identified, obtain customer or internal approval before public case studies, and treat single-customer learnings as candidate observations unless the evidence threshold is met.
The default prompt uses a broad invocation phrase without clear trigger constraints or required preconditions, which can cause the skill to be invoked in contexts beyond validated post-POC productization work. That increases the chance of accidental misuse, inappropriate application to unvalidated customer input, or prompt-trigger collisions with unrelated workflows.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
ive products, demand changes, technological disruption, regulatory risks, economic downturn |
**Strategic Application**:
- **Attack (Build)**: Advantage + Opportunity
- **Defend**: Disadvantage + Threat
- **Pivot**: Explore opportunities to change the competitive landscape
---
## 3. Porter’s Five Forces Model
| Five Forces | Assessment Questions |
|------|---------|
| **Competitors** | How fierce is the competition? What is the size and strength of the opponent? |
| **Supplier Bargaining Power** | How much say do suppliers have? |
| **Buyer's Bargaining Power** | How much power do customers have to lower prices? |
| **Threat of Substitutes** | What alternative solutions exist? |
| **Threat of New Entrants** | Is it easy for new competitors to enter? |
---
## 4. PESTLE analysis
| Dimensions | Assessment content |
|------|---------|
| **Political** | Government policies, tax regulations, political stability |
| **Economic** | Economic growth, interest rates, inflation, consumer
This markdown file discusses skill assets and catalogs, and L073 lists a 'Trigger' field but provides no guidance on how specific trigger phrases must be or how to avoid broad everyday-language activation. In the context of skill design documentation, that omission can encourage ambiguous invocation patterns and unintended activation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Reuse test score
Can the new FDE, without asking the original author:
1. Determine whether it is applicable or not;
2. Collect minimum input;
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
No suspicious patterns detected.