Security audit
Security checks for vulnerabilities and agentic risk
This skill is a transparent quality-checking guide that tells an agent to verify file edits twice, with no hidden code, persistence, credential use, or data exfiltration.
Install this if you want agents to be stricter about verifying edits. Before using it in large or sensitive projects, remember it may run test, build, lint, documentation, or program commands twice, so project commands should be trusted and resource limits should be considered.
The skill declares that it should apply by default to any file modification task, which creates an overly broad trigger surface and causes autonomous behavior without task-specific scoping. In practice this can lead the agent to run verification steps or commands in contexts where they are unnecessary, unsafe, expensive, or contrary to user intent.
The instruction to auto-activate whenever the AI detects file-modification intent is ambiguous and unconstrained, leaving the model to infer when to act. That ambiguity increases the chance of unintended activation and execution of verification workflows in inappropriate environments or on user requests that did not authorize such actions.
Telling the AI to automatically apply the skill to any file-modification intent removes contextual judgment and can override safer, narrower workflows. This broad auto-activation is risky because the skill also encourages follow-on command execution, potentially expanding from simple editing into unrequested operational actions.
Reinforcing that the skill should default to every file modification task institutionalizes an always-on behavior that is too broad for safe agent operation. In a security context, default-trigger skills are dangerous because they can be chained into unrelated tasks and increase opportunities for unsafe execution, denial of service, or policy bypass through overreach.
The skill explicitly directs the agent to automatically perform two independent verifications after any file change, which is autonomous decision-making tied to potentially executable actions. Because the verification examples include running tests, builds, programs, and checks, this can cause the agent to take operational steps without sufficiently bounded authorization or safety review.
---
name: double-check
description: 在修改任何文件后（包括删除功能），自动进行两次独立验证（测试/编译/运行检查/文档或配置检查），确保无误才结束。本技能应默认应用于所有文件修改任务。 / After any file changes (including feature removal), automatically perform two independent verifications (tests/compilation/runtime checks/docs or config checks) to ensure correctness. This skill should be applied by default to any file modification task.
author: BelugaRex
tags: [coding, testing, verification, quality-assurance, bilingual]
---
The skill content is presented as a fixed Chinese/English bilingual format, and the metadata tags it as bilingual, but there is no indication that the user can choose language or opt out. This may impose a language/locale preference without explicit user consent.
No suspicious patterns detected.