Security audit
Security checks for vulnerabilities and agentic risk
This local document checklist has inconsistent permissions and overstated validation claims, but shows no harmful behavior.
Use only text or documents you choose, and restrict file access through the host. Do not grant write or web access for this checker. Treat its result as a keyword checklist requiring human review before publication. Permission declarations and CLI documentation need correction; investigation of the scanner's partial coverage found no material missing executable component.
The manifest declares filesystem access disabled, but the documented workflow requires reading local documents and the implementation supports local file reads. This is a permission-contract mismatch that could expose unpublished government material to unauthorized processing if the host trusts the declaration without enforcing it; no sandbox bypass or external transmission is demonstrated.
The workflow instructs the agent to read input files and execute a Python script despite filesystem and subprocess permissions being explicitly disabled. The allowed-tools list also includes Bash and other capabilities inconsistent with those restrictions, creating conflicting authorization signals for an agent handling potentially sensitive documents.
The --file argument reaches open(...).read() without application-level path restrictions, contradicting the declared prohibition on filesystem access. If execution is permitted without host enforcement, a caller can cause any UTF-8-readable file accessible to the process to be processed; the script reports keyword presence rather than raw contents and contains no network exfiltration.
The skill explicitly requires activation on any listed phrase, including "batch check old replies for missing items," which could equally refer to customer-support messages or ordinary correspondence. Unlike the government-specific purpose, this activation instruction provides no requirement that the replies concern government information disclosure and no exclusion for unrelated contexts.
