Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only coding-principles skill with broad Chinese triggers, but it does not install code, access sensitive data, persist, or execute commands.
Installers should expect this skill to influence ordinary coding conversations, especially Chinese prompts about writing code, fixing bugs, or adding features. It appears safe from a security perspective, but users who want opt-in-only behavior may prefer narrower trigger wording.
The '禁用触发' section uses very broad phrases like '帮我写个...', '修复这个', and '添加功能', which are common in normal software conversations. This can cause the skill to over-trigger on routine requests and override user intent by forcing a prescribed workflow, creating prompt-scope interference and unpredictable agent behavior.
The skill metadata and content are written entirely in Chinese and present Chinese trigger phrases as the activation interface, without offering a language choice or documenting that the skill is intentionally Chinese-only. This can violate language/locale policy if the skill implicitly forces a specific language on users.
The listed trigger phrase "编程法则" is generic, and the document later broadens activation to common user requests. This creates a risk of unintended invocation because ordinary coding conversations could match the trigger without clear boundaries.
No suspicious patterns detected.
