Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent industry ecosystem report generator that uses web research and local report/session files in ways that match its stated purpose.
Before installing, expect the skill to perform web research, create or overwrite an ecosystem Markdown report under output/{industry-slug}, and update the local session.json workflow state. Review the generated sources and report content because third-party web pages may be incomplete, stale, or misleading.
The skill writes output/{industry-slug}/02-ecosystem.md and updates session.json, but the description does not clearly warn users that running it mutates local files and workflow state. This can lead to unintended overwrites, stale state transitions, or users invoking the skill under the mistaken assumption that it is read-only.
The workflow instructs the agent to perform web_search and webfetch, but the skill description does not warn that it retrieves external content. This matters because fetched web content is untrusted and can introduce prompt-injection attempts, inaccurate data, privacy issues, or unexpected network activity during execution.
This markdown template forces a specific language/locale in its natural-language instructions and examples. Under the policy, language constraints should either be optional for the user or clearly documented as region- or compliance-specific.
No suspicious patterns detected.
