Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Chinese-language API documentation skill that writes a generated Markdown document, with no hidden execution, credential use, or network behavior found.
Install only if a Chinese-language API documentation workflow fits your project. Confirm where the generated document should be saved, especially if doc/API接口设计文档.md already exists, because the skill directs the agent to use that fixed path.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
GET /api/users/{id}
POST /api/users
PUT /api/users/{id}
DELETE /api/users/{id}
❌ 错误：
GET /api/getUserById
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
GET /api/getUserById POST /api/createUser PUT /api/updateUser DELETE /api/deleteUser
### 使用正确的HTTP方法
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- `GET /api/users/{id}` - 获取单个用户
- `POST /api/users` - 创建用户
- `PUT /api/users/{id}` - 更新用户
- `DELETE /api/users/{id}` - 删除用户
## 参数命名
The natural-language description specifies the skill behavior entirely in Chinese and presents it as the standard mode of operation, with no indication that users may choose another language. Under the policy rule, forcing a specific language without user opt-in can be a locale/language policy violation when no justification is provided.
The skill explicitly instructs automatic creation of a project directory and writing a fixed file into the repository without requiring user confirmation or clarifying that it will modify local files. In an agent setting, this creates an unsafe side effect boundary: a user may request design help but the skill causes persistent workspace changes, which can overwrite expected workflows, violate least surprise, or be chained with other instructions to plant or replace documentation artifacts.
This JSON template contains the sample value "示例数据", which implies a specific language choice in a file intended as a generic API response template. Because the file does not document that it is region-specific or offer locale selection, it may violate the policy against forcing a language without user opt-in.
This markdown template presents all field labels and guidance in Chinese only, which can be interpreted as forcing a specific language for skill users or contributors. The file does not offer a language choice or explain that the template is intentionally region-specific, so it matches the language/locale policy concern.
The entire skill document is written only in Chinese and provides no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without opt-in can be a policy concern when no justification is documented.
The text states that all API errors must follow this specification, and the specification defines error messages entirely in Chinese. Because the document presents this as a universal requirement rather than a region-specific or opt-in localization choice, it creates a natural-language locale policy concern.
The file presents the skill guidance entirely in Chinese and frames it as a normative standard ('本规范定义了...命名规则') without indicating that language choice is optional or context-specific. Under the policy criteria, forcing a specific language or locale without user opt-in can be a natural-language policy violation.