Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Chinese-language application security review guide with no install scripts or hidden execution behavior.
Install this when you want Chinese-language security audit guidance, especially for China-region business contexts. Use it with explicit audit targets because it may steer the agent to inspect auth, secrets references, environment files, dependency files, payment callbacks, and admin routes.
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
// ❌ BAD: dangerouslySetInnerHTML with user input
<div dangerouslySetInnerHTML={{ __html: userComment }} />
// ✅ GOOD: Sanitize HTML
import DOMPurify from 'isomorphic-dompurify'
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
// ❌ BAD: dangerouslySetInnerHTML with user input
<div dangerouslySetInnerHTML={{ __html: userComment }} />
// ✅ GOOD: Sanitize HTML
import DOMPurify from 'isomorphic-dompurify'
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
### 8. 软件和数据完整性失败（A08:2021）
**检查项：**
- [ ] 更新包、CI 制品与镜像校验签名或摘要；禁止未校验的远程脚本 `curl | bash`。
### 9. 安全日志与监控失败（A09:2021）
This manifest-style markdown file defines many activation triggers that are extremely broad, including terms like "security", "安全", "漏洞", "audit", and "审计". Without contextual constraints, negative examples, or narrower scope rules, these phrases could cause unintended invocation in ordinary conversations or in non-code security discussions.
Overly Broad Trigger: '安全' is too short and may match unintended inputs
Overly Broad Trigger: '漏洞' is too short and may match unintended inputs
The description states the skill is for use in "中国等地区" scenarios and the document is written to a China-specific business context, which can amount to a locale-specific policy baked into the skill behavior. The file does not clearly state that users can opt into other languages or locales, nor that the restriction is mandatory for a compliance-only regional tool.
Overly Broad Trigger: '鉴权' is too short and may match unintended inputs
Overly Broad Trigger: '授权' is too short and may match unintended inputs
Overly Broad Trigger: '密钥' is too short and may match unintended inputs
Overly Broad Trigger: '审计' is too short and may match unintended inputs
Overly Broad Trigger: '等保' is too short and may match unintended inputs