Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent architecture-design helper, but it can write architecture documents locally and publish or read from connected third-party tools without clearly requiring user confirmation.
Install only if you are comfortable with the agent creating local architecture documents and using connected Notion/Feishu or Figma accounts for this workflow. Before running it on sensitive projects, instruct the agent to keep output in chat unless you explicitly approve a file path or external publication destination.
The skill says architecture documents may be published to Notion/Feishu when the connector is available, but it does not require explicit approval before sending content to external services. Architecture documents often contain sensitive internal system design, workflows, and technology choices, so silent transmission to third-party platforms can create confidentiality and compliance risks.
The skill instructs the agent to save the generated architecture document as a local Markdown file by default, but it does not require confirming file creation, path, or overwrite behavior with the user. This can cause unintended persistence of potentially sensitive architecture details on the local system, especially in environments where users expect analysis-only behavior.
This markdown file contains user-facing natural language exclusively in Chinese, starting with the title and continuing throughout the document. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no justification or alternative is provided.
