Security audit
Security checks for vulnerabilities and agentic risk
This is a planning-only skill that documents how to generate project plans and does not request installation scripts, credentials, persistence, or privileged access.
Before installing, users should be comfortable with Chinese-language documentation and should invoke it explicitly for project-planning tasks. No special credential, install, or persistence risk was found in the artifact.
The manifest description and user-facing documentation are entirely in Chinese, which implicitly constrains the skill to a specific language without any opt-in or stated locale justification. Under the policy, language constraints should either be optional for the user or explicitly justified as region-specific.
The invocation guidance includes a very broad natural-language trigger ('使用 eo-ability-plan 规划一个[项目类型]项目') without defining allowed arguments, scope boundaries, or confirmation requirements. In agent ecosystems, overly generic triggers can cause unintended activation, ambiguous routing, or prompt injection through user-supplied project descriptions that are forwarded into downstream planner components.
No suspicious patterns detected.
