Security audit
Security checks for vulnerabilities and agentic risk
The skill processes evidence supplied by the user, with inconsistent permission declarations but no observed hidden access or harmful behavior.
Use only input files you intend to share with the agent, and enforce file-access limits in the host rather than relying on filesystem:false. The permission declarations should be corrected. Treat the score as a summary of supplied source labels and verify original sources yourself. All bundled files were inspected; runtime sandbox behavior remains unverified.
The manifest declares filesystem access disabled while advertising file-reading tools and a CLI whose JSON import reads local files. This understates the skill's actual access requirements and can mislead permission-based review or deployment; it does not demonstrate a bypass of an independently enforced filesystem sandbox.
The --from option passes a caller-controlled path directly to open(), despite the declared prohibition on filesystem access. If executed with broader host permissions, it can read any accessible path, with selected fields from compatible JSON exposed in output; ordinary user-authorized imports are legitimate, and no network exfiltration or sandbox escape is shown.
