Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed product-planning workflow that creates prototypes and handoff documents, with review gates and no hidden execution or persistence behavior found.
Install this if you want a structured Chinese-first product handoff workflow. Be aware it can create local prototype files and, when connected, online Feishu or Tencent documents containing your product details; confirm the destination and sharing settings before using it with confidential material.
Mandating Chinese-only communication without checking user preference can create unsafe or unreliable interactions by preventing users from understanding requirements, outputs, or review gates. In a workflow that depends on user confirmation at multiple stages, language coercion increases the risk of mistaken approvals, misunderstood scope, and flawed downstream artifacts.
The trigger conditions are broad enough to capture many ordinary product-related requests, which can cause the skill to activate when the user did not explicitly ask for this workflow. Overly aggressive activation can steer conversations into this skill's prescribed process, potentially suppressing other more appropriate tools or causing unintended document/prototype generation actions.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- [ ] Are edge cases explicitly listed (0 items, 10000 items, special characters, long text)?
- [ ] Are success metrics measurable (not "better experience" but "reduce X by Y%")?
- [ ] Is the scope boundary explicit in "Out of Scope"?
- [ ] Can a developer implement this without asking additional clarifying questions?
- [ ] Are API endpoints clearly listed with request/response examples?
## Stage D: API Definition Review