Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-language project-planning template helper that may create or update documentation files, with no code execution, network access, credential access, or persistence behavior found.
Install this if you want a Chinese-language guided workflow for collecting project requirements and producing planning documents. Before letting it write files, confirm which template files will be created or updated, especially if your project already has files with the same names.
The activation description is broad enough to match many ordinary project-related requests, which can cause the skill to trigger when the user did not explicitly ask for requirements elicitation or template generation. This increases the chance of unintended workflow takeover and can steer the agent into collecting or producing files outside the user's immediate intent.
The trigger list contains ambiguous phrases like wanting to start a project or build a system, without scope limits or disambiguation rules. In an agent environment, such broad matching can misfire on common conversations and cause the skill to collect excessive information or redirect the session into document-authoring actions the user did not request.
The skill instructs the agent to generate or update files such as main.md and requirements.md but does not clearly warn that documentation files may be created or modified. This can lead to silent workspace changes, surprising the user and potentially overwriting existing project documentation if the skill is activated unintentionally.
This markdown file describes login, registration, and authenticated user-info endpoints, including password fields and Bearer token usage, but provides no warning about sensitive credential handling, token secrecy, or privacy impact. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors affecting user data or privacy.
The entire template, including headings and instructions, is written in Chinese and provides no indication that other languages are supported. Under the policy, a skill should not impose a specific language or locale unless the user is given an opt-in choice or the restriction is clearly documented and justified.
This markdown template is written entirely in Chinese and presents itself as the default project-development guidance template, but it does not mention any language choice, opt-in, or locale limitation. Under the policy rule, forcing a specific language without user selection is a natural-language policy concern.
The entire template, including the title and all section labels, is written in Chinese and provides no indication that another language may be used based on user preference. Under the policy, a skill that enforces a specific language without opt-in is a natural-language locale violation unless the regional constraint is explicitly documented and justified.
The interface list includes a DELETE /resources/{id} endpoint, which can affect user data or system integrity, but the markdown provides no warning that deletion may be destructive or irreversible. Under SQP-2 for markdown, descriptions should warn about behaviors that could impact user data.
This markdown template uses Chinese throughout and does not indicate that the language is optional, selectable, or required for a justified region-specific use case. Under the policy rule for natural-language constraints, forcing a single language without user opt-in can be a locale-policy issue.
