Security audit

Concept Implementation — Modular Monolith

Security checks for vulnerabilities and agentic risk

Overview

This skill provides architecture guidance for mapping confirmed concept models into modular-monolith code and does not show hidden execution, credential access, persistence, or destructive behavior.

Install this skill if Chinese-language architecture guidance for concept-model implementation is acceptable. Review generated code changes as usual, especially CI boundary checks, dependency choices, and any application persistence the agent creates at your request.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The short description is written entirely in Chinese, which imposes a specific language/locale in the skill's natural-language interface without any indication that the user can choose another language. The policy requires flagging language or locale constraints unless the skill explicitly offers choice or documents a justified regional limitation.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This markdown file contains natural-language instructions only in Chinese, which can impose a language requirement on users or maintainers without opt-in. The policy allows locale constraints only when choice or clear regional justification is provided, and neither appears in the file.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This file presents all user-facing instructional content exclusively in Chinese, and there is no indication that the user can opt into another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Low

Confidence: 78% confidence
Finding: The file begins with a Chinese-only title ("Rust 落地") and the document content is written in Chinese, with no indication that the language choice is optional or limited to a justified region-specific audience. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue.

Static analysis

No suspicious patterns detected.