No. The agent must not run a live privileged security assessment when the host ignores tool restrictions. `allowed-tools` metadata is only declarative; permission boundaries require host enforcement. Safe alternative: perform an offline, read-only analysis of supplied code, logs, configurations, and artifacts. Identify risks, sanitize sensitive data, and provide a remediation plan or non-executing test procedures. Live testing requires explicit authorization plus enforced host controls. A mat...
Installs into .claude/skills of the current project.
Are you the author of Common Llm Security?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/hoangnguyen0403-common-llm-security-b0b11fe0)
No. The agent must not run a live privileged security assessment when the host ignores tool restrictions. `allowed-tools` metadata is only declarative; permission boundaries require host enforcement.
Safe alternative: perform an offline, read-only analysis of supplied code, logs, configurations, and artifacts. Identify risks, sanitize sensitive data, and provide a remediation plan or non-executing test procedures. Live testing requires explicit authorization plus enforced host controls.
A matching SHA-256 hash proves integrity: the package bytes match the expected content. It does not prove trusted authorship, safety, authorization, benign behavior, or that the package’s tool restrictions are enforced.
