Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a code-review helper, but its paid “full implementation” claims are not supported by the incomplete and malformed artifact.
Review this carefully before installing, especially if you would rely on it for PR gates, CI blocking, paid security review, or audit decisions. It does not show malicious system access, but its advertised coverage and premium claims are not backed by the artifact.
The manifest description says this is a premium package with enterprise support, but the skill metadata describes a code-review capability. This mismatch can mislead users, reviewers, or marketplaces about the skill’s actual purpose, increasing the risk of deceptive installation, policy evasion, or trust abuse in a security-sensitive tool category.
The skill advertises a four-perspective review with severity and remediation, but only the SECURITY path performs substantive checks; PERFORMANCE, CORRECTNESS, and STYLE are stubs. This can mislead users into trusting incomplete reviews, causing important defects to be missed in CI, PR gating, or security audit workflows.
The manifest description is written entirely in Chinese and presents the skill behavior in that locale without indicating that users may choose another language. Under the policy, locale constraints should be optional or explicitly justified; no such opt-in or justification is provided here.
The listed activation words include "审查", which is a generic verb meaning "review/examine" and can easily appear in ordinary conversation outside the intended skill context. The file does not provide narrowing conditions, scope constraints, or negative examples to clarify when this skill should or should not activate.
The comment states that actual performance checks will parse AST, but the function currently does nothing. While not directly exploitable as code execution, this is a security-relevant integrity issue because users may overestimate the analyzer's coverage and approve unsafe or inefficient code based on false assurance.
No suspicious patterns detected.
