Security audit
Security checks for vulnerabilities and agentic risk
This is a coding-guidance skill for service-layer refactoring and does not contain executable code, persistence, credential handling, or hidden data movement.
Install this only if you want a project-specific coding skill that may consult Weline engineering conventions and steer service-layer refactors. Review the referenced local standards if they exist in your repo, because this package does not include them.
The invocation guidance uses broad keywords like 'service', 'business logic', and 'API layer', which are common across many software-engineering tasks. This can cause the skill to activate outside its intended boundary, increasing the chance it influences unrelated work, overrides more appropriate specialist behavior, or processes sensitive context it does not need.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- `AI-ENTRY.md`
- `CLAUDE.md`
- `dev/ai/skills/service-development/SKILL.md`
- `dev/ai/skills/code-generation-standards/SKILL.md`
- `dev/ai/skills/module-development/SKILL.md`
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- `AI-ENTRY.md`
- `CLAUDE.md`
- `dev/ai/skills/service-development/SKILL.md`
- `dev/ai/skills/code-generation-standards/SKILL.md`
- `dev/ai/skills/module-development/SKILL.md`
# Responsibilities
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- `CLAUDE.md`
- `dev/ai/skills/service-development/SKILL.md`
- `dev/ai/skills/code-generation-standards/SKILL.md`
- `dev/ai/skills/module-development/SKILL.md`
# Responsibilities
The instruction 'Do not hardcode user-facing text' followed by 'Use i18n for user-facing text' establishes a language/locale handling policy, but the file does not indicate user choice or opt-in for locale selection. Under the stated policy criteria, forcing a locale-related convention without user choice can be a natural-language policy concern unless clearly justified.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Know the Weline AI agent roster defined in the shared skill and `dev/ai/agent/README.md`.
- Keep work inside this specialist's ownership boundary.
- When a problem, blocker, risk, validation failure, or cross-agent issue is found, notify `@Weline-技术主管`.
- Do not silently expand scope to fix another agent's area.
- Include collaboration status in the final report.
No suspicious patterns detected.