Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Git commit report generator with no artifact-backed signs of hidden execution, exfiltration, persistence, or privilege escalation.
Installers should expect Chinese help text and report examples, and should verify package completeness because the referenced executable is not present in the inspected artifact. Only point it at repositories whose Git history you are comfortable summarizing in a work report.
The README describes the skill in Chinese ('分析 Git 提交自动生成工作日报'), indicating a language-specific behavior, but there is no indication that users can choose the output language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy requirements for user choice or documented justification.
The manifest description, headings, option explanations, and all usage/output examples are written entirely in Chinese, which imposes a specific language on users. The file does not indicate that Chinese is optional, configurable, or justified by a region-specific purpose.
The manifest’s user-facing description, command description, and help text are entirely in Chinese. This imposes a specific language on users without documenting that the skill is Chinese-only or offering any language/locale choice, which fits the language policy violation criteria.
No suspicious patterns detected.
