Security audit
Security checks for vulnerabilities and agentic risk
This skill gives safety guidance for bounding AI-agent loops and does not request hidden access, persistence, or unrelated authority.
This appears safe to install as a coding guidance skill. Users should expect it to influence agents toward adding explicit loop limits, failure escalation, and refusing requests to simply raise recursion or iteration limits without diagnosis.
This is a JSON manifest-style file, so vague-trigger review applies. The trigger "Any cyclic LM workflow" is very broad and lacks clear scope boundaries or exclusion conditions, making it unclear when this operation should or should not be selected.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
| **Claude Agent SDK / Messages API** | `max_tokens` per call | Caller-controlled `max_iterations` / `tool_use_budget`; explicit "step budget" pattern in Computer Use | App code (the SDK does not own the loop) | Letting the model decide via "should I stop?" reflection — same content can be re-emitted forever |
| **OpenAI Agents SDK / Assistants** | `max_completion_tokens`, `max_prompt_tokens` | `max_turns` per Run | Run config | Same reflection footgun; also `tool_choice="auto"` can re-call the same tool |
| **DSPy** | None for inference; `Evaluate` is bounded by dataset size | `max_bootstrapped_demos`, `max_labeled_demos` on optimisers | Optimiser config | "Train until metric stops improving" — no early-stopping primitive ⇒ caller must set explicit budget |
| **AutoGen** | `max_consecutive_auto_reply` per agent | Same | Per-Agent | Group chat can loop forever if every agent's auto-reply triggers another |
| **AutoGPT / BabyAGI** *(historical)* | None initially; later `--continuous-limit` | Explicit step budget required | App code | Self-evaluation "task not complete" → infinite. Why these systems acquired the reputation they did |
| **Aider** | Human REPL as outermost bound | `--auto-test` retries are single-pass; `/test` is one-shot | Aider process state | Auto-fix loop without an explicit retry cap → silent token burn |
| **LangChain `AgentExecutor`** *(legacy)* | `max_iterations=15` hardcoded default | Same + `max_execution_time` | AgentExecutor config | The default was acknowledgement that LMs don't self-terminate |
This markdown skill mixes English body text with Chinese headings such as the activation-rules section, but nowhere states that the skill is Chinese-localized only or offers the user a language/locale choice. Under the policy rule, forcing a specific language or locale without opt-in is a natural-language policy concern.
The phrase "Designing a new cyclic flow" is underspecified and could match a wide range of ordinary design discussions. It does not state the exact conditions under which the operation applies or provide examples of in-scope versus out-of-scope cases.