Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local, bounded collaboration-log summarizer with disclosed safeguards and no evidence of hidden network, persistence, or privilege behavior.
Install only if you are comfortable giving the agent the specific collaboration files you name. The redactor covers common PII and credential patterns but is not a complete secret scanner, so pre-redact live credentials, customer data, and sensitive HR material before use.
The skill promises evidence-based extraction, redaction, and controlled file-output behavior, but the analyzed implementation apparently does not perform those protections and may emit data to stdout. This is dangerous because users may rely on the claimed sanitization and output constraints when handling sensitive collaboration logs, causing unintended disclosure of PII, credentials, or internal project data.
Without declared permissions the skill's intent is opaque and cannot be validated.
The module docstring labels the skill as "Office Collaboration Radar EN," and the CLI description later repeats the English-only framing. For a general processing layer, this natural-language restriction appears to force a specific language/locale without user opt-in or an explicit region-specific compliance justification.
Detected: suspicious.exposed_secret_literal
