Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because its promised file restrictions and automatic safeguards are not enforced by the supplied code.
Use sanitized traces within an independently enforced project sandbox. Before relying on this skill, require enforced path and symlink restrictions plus diagnostic redaction. Treat it as a trace analyzer: automatic stopping and token-budget protection are not implemented, and any external stopping mechanism needs a clearly defined scope.
The skill promises project-directory confinement and no symlink following, but the supplied trace reader opens the caller-provided path without enforcing either restriction. An out-of-project path or symlink can therefore cause unauthorized local reads, with trace-shaped file contents potentially appearing in diagnostic output; no network exfiltration is demonstrated.
The workflow instructs the agent to trigger a system-level circuit break automatically when a loop or stall is confirmed; the instruction is repeated at L121. Although circuit-breaking is disclosed, the skill does not warn that abruptly interrupting active operations may leave partial changes or inconsistent state, nor clarify which processes the interruption affects.
Path(p).read_text() accepts absolute paths and parent-directory traversal and follows symlinks without checking a trusted project boundary. A caller controlling --trace can make the tool read files accessible to its process outside the authorized scope, and matching trace content can be exposed through diagnostics.
