Security Guardian

Guidance

What to consider before installing: - Code review: The packaged scripts are small and readable; review them yourself before running. The skill has no homepage or provenance, which lowers trust — prefer skills with verified sources. - Run scope: Use the tool only on intended project workspace paths. The secret scanner blocks system roots by default; avoid using --force unless you explicitly intend to scan system directories. - Handling findings: Treat any reported secrets as sensitive. Do not paste findings (secret values) into public channels. Use a vetted credential manager (review the mema-vault skill) to rotate and vault secrets rather than storing them in plain text. - Environment: Trivy may download vulnerability DB updates during scans; run it in an environment where network access and telemetry are acceptable. Consider running scans in an isolated environment if you have high security requirements. - False positives & limitations: The regex patterns can generate false positives and may miss obfuscated secrets; use findings as actionable leads, not absolute truth. - If you need higher assurance: ask the skill author for provenance (repo/homepage, signed release) or reimplement equivalent checks from known tools. If you will integrate with an external vault, validate that integration code and do not give vault credentials to untrusted skills.