Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed investigation workflow that encourages gathering evidence before decisions, with no hidden code, persistence, credential handling, or exfiltration behavior found.
Install this if you want an agent to investigate before making recommendations. Be aware that it encourages broad fact gathering, including reading code, checking logs or git history, and running tests, so give clear scope and avoid directing it at sensitive logs or private repositories unless that access is intended.
The file presents the skill primarily in Chinese and includes an English trigger line, but it does not state that the user may choose their preferred language or that the skill is limited to a Chinese-speaking context. This can create a language-policy issue because the skill appears to impose a locale/language presentation without explicit opt-in or justification.
The dispatch condition is very broad ('use when comprehensive fact gathering and analysis are needed'), which can cause the agent to be invoked in many loosely defined situations. Over-broad routing increases the chance of unnecessary tool use, scope creep, and investigation actions such as code inspection, log review, or command execution in contexts where a narrower, safer skill would suffice.
The description, headings, instructions, and output format are entirely in Chinese, implicitly requiring the skill to operate in that language. There is no opt-in, fallback, or statement that the skill is intended only for a Chinese-language or region-specific context, which makes this a natural-language locale policy issue.
The manifest description is entirely in Chinese and presents the skill as Chinese-source-material quotations, with no indication that language selection is optional. Under the policy rule, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the constraint is explicitly justified.
No suspicious patterns detected.
