Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed code-review skill with optional installer and guardrail files, and I found no hidden execution, network fetching, exfiltration, or destructive behavior.
Install this only if you want a persistent code-review skill available to your agent. Review the destination before running install.sh, especially if you already have a code-quality-guard folder, and treat AGENTS-template.md, hooks.json, --fix, --triage, and history tracking as optional behaviors to enable deliberately.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
│ ├── pr-review-guide.md # 7 步 PR 审查 │ ├── examples.md # 语气 / 评分校准 │ ├── AGENTS-template.md # 可选：丢进仓库当 AGENTS.md 强制规范 │ └── hooks.json # 可选：PreToolUse 拦截 rm -rf / git push --force ├── install.sh # 一键安装到 5 类智能体 └── LICENSE # MIT
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
│ ├── pr-review-guide.md # 7 步 PR 审查 │ ├── examples.md # 语气 / 评分校准 │ ├── AGENTS-template.md # 可选：丢进仓库当 AGENTS.md 强制规范 │ └── hooks.json # 可选：PreToolUse 拦截 rm -rf / git push --force ├── install.sh # 一键安装到 5 类智能体 └── LICENSE # MIT
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
│ ├── pr-review-guide.md # 7 步 PR 审查 │ ├── examples.md # 语气 / 评分校准 │ ├── AGENTS-template.md # 可选：丢进仓库当 AGENTS.md 强制规范 │ └── hooks.json # 可选：PreToolUse 拦截 rm -rf / git push --force ├── install.sh # 一键安装到 5 类智能体 └── LICENSE # MIT
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
itorial-extensions.md # R7 / UX1 / 防过度告警 │ ├── source-coverage.md # 书籍矩阵（深度模式） │ ├── pr-review-guide.md # 7 步 PR 审查 │ ├── examples.md # 语气 / 评分校准 │ ├── AGENTS-template.md # 可选：丢进仓库当 AGENTS.md 强制规范 │ └── hooks.json # 可选：PreToolUse 拦截 rm -rf / git push --force ├── install.sh # 一键安装到 5 类智能体 └── LICENSE # MIT
## 安装
### 方式一：手动复制
把整个文件夹复制到对应智能体的技能目录：
| 智能体 | 全局目录 | 项目目录 |
|--------|----------|----------|
| Cursor | `~/.cursor/skills/code-quality-guard/` | `<仓库>/.cursor/skills/…` |
| Codex | `~/.codex/skills/…` | `<仓库>/.codex/skills/…` |
| Claude Code | `~/.claude/skills/…` | `<仓库>/.claude/skills/…` |
| WorkBuddy | `~/.workbuddy/skills/…`
The declared description presents a code-review/audit skill whose purpose is to inspect code and produce review findings. The supplied code does not perform any code analysis, trigger detection, scoring, or review output. Instead, it is an installation utility whose primary purpose is to deploy the skill into various agent directories on disk. This is a materially different behavior and includes undeclared filesystem-writing and multi-platform installation capabilities. These are not merely supporting internals of the review logic; they are the entire function of the provided code chunk.
Referenced artifact was not completely inspected
| **Quick** | pasted function / < ~50-line diff / “扫一眼” | This `SKILL.md` + cheat-sheet below | `decay-risks.md` only for a borderline Critical |
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Updater / installer: signature verification skipped, missing pubkey, artifacts unsigned while “auto-update” is on.
- Production DevTools / debug features left enabled in release builds.
- CSP `null` / wildly open `connect-src` / `unsafe-eval` in production without documented need.
- `curl | sh` or equivalent in docs/scripts aimed at end users.
- Dependency or plugin allowlists that effectively disable sandboxing for convenience.
### Severity guide
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Test names express scenario and expected outcome? Assertions have message strings?
- If vague/no messages → 🟢 Suggestion: Test Obscurity (Meszaros — xUnit Test Patterns, Assertion Roulette p.224).
**Output rule:** If all three signals clean → no Test findings, proceed to report. If findings exist →
add them in Iron Law format, labeled with the test risk name. Note in Summary: "Consider a full
test-quality review for systemic test problems."
The README says the skill can be invoked by phrases like “review this PR”, “结对评审”, and “发版前扫一眼”, which are common everyday requests rather than narrowly scoped trigger phrases. Without clearer trigger constraints or exclusion conditions, an agent could invoke this skill unintentionally during ordinary conversation about reviews.
The trigger description includes broad phrases such as "any issues", "smells", "refactoring", "tech debt", and "architecture health", which can appear in ordinary conversation across many contexts. Although some exclusions are listed later, the positive trigger scope remains open-ended enough to cause unintended invocation outside a clearly bounded review workflow.
The instruction to 'Proactively use the skill whenever discussing code quality, PR reviews, architecture health, test quality, or technical debt' covers broad, common topics and may match many ordinary conversations. Although a later boundary note exists, the trigger scope here is still expansive and lacks concrete examples of what should not count beyond two brief exclusions.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## Skill Integration (per agent)
- **Codex CLI / Claude Code / Cursor / Gemini / generic agents:** the skill loads from the agent's
skills folder (`~/.codex/skills/`, `~/.claude/skills/`, `~/.agents/skills/`, etc.). Invoke by name
or let it auto-trigger on code-quality discussion.
- **WorkBuddy:** the skill lives in `~/.workbuddy/skills/code-quality-guard/`; the assistant loads
it via the Skill tool when code quality is in scope.
The natural-language instructions and headings are primarily in Chinese, but the file does not state that the skill is region-specific or give users an option to choose another language. That can conflict with a language/locale policy requiring user choice or explicit justification for a fixed language.
The instruction says to use the user's language for prose, but explicitly requires English for field labels, book titles, smell names, and headers. This is a locale/language constraint expressed in natural language, and the file does not present it as an opt-in choice or clearly justify the restriction as region-specific.