Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow overview skill with no executable code, persistence, credential handling, or hidden data access.
This skill appears safe to install as a workflow overview. Users should treat it as process guidance, and publishers should clean up the skill-count and slug inconsistencies so agents do not route to the wrong companion skill.
The activation condition is extremely broad, effectively making this overview skill a default entry point for nearly any development task. Overly broad routing can cause inappropriate skill selection, increase prompt-surface exposure to additional instructions, and crowd out more specific safety- or task-relevant skills at the moment they are most needed.
The natural-language content appears to enforce a single language for the skill's instructions and usage guidance, but it does not state that Chinese is optional or provide an opt-in language choice. Under the language/locale policy, a skill should not force a specific language unless the constraint is explicitly justified.
At L015 the documentation says the skill suite has '9' skills, but L139-L155 list 13 skills and earlier sections also name more than 9 entries. This is an active contradiction in the skill's own documentation, which can mislead users about the actual suite contents and navigation targets.
The overview refers to the skill as superpowers-executing-plans at L033, but the publishing table says the actual ClawHub slug is openclaw-executing-plans at L155. For a navigation/entry-point skill, this contradiction matters because it can direct agents to a nonexistent or wrong identifier.
No suspicious patterns detected.
