Security audit
Security checks for vulnerabilities and agentic risk
The skill does what it claims, but its broad triggers can add persistent Claude configuration files to projects without a clearly explicit setup request.
Install only if you want agents to create and rely on .claude/ project instructions. Review the generated files before future work, especially CLAUDE.md and project-private skills, and avoid invoking it from casual mentions or in repositories where you do not want persistent agent behavior changes.
The skill documentation is written entirely in Chinese and does not indicate that other languages are supported or that Chinese is required for a region-specific purpose. This can violate language/locale policy expectations when users are not given an opt-in or alternative.
The skill description uses very broad trigger phrases such as "Claude Code", ".claude config", and "project standards," which can cause the skill to activate in many contexts beyond explicit user intent. Over-broad activation increases the chance an agent will perform filesystem changes or setup actions in the wrong project or at the wrong time.
The skill instructs the agent to create persistent configuration artifacts in whatever it identifies as the target project directory, potentially across many repositories and sessions. Because the trigger conditions are broad, this persistence can propagate unintended instructions or policy files into unrelated projects, making later agent behavior harder to predict and control.
- ❌ Wrong: `/home/user/workspace-xiaolong/.claude/` (workspace root)
- ✅ Correct: `/home/user/eave-web/.claude/` (actual project being developed)
Always identify which project you're working on first, then check/create `.claude/` in **that** directory.
## When to Use
The "When to Use" section repeats ambiguous conditions like entering a new project directory or merely mentioning related terms, without requiring a clear user request to modify the project. This can lead to unintended invocation and unauthorized or surprising changes to project state.
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- MUST use functional components with hooks only
- NEVER use class components
- MUST use TypeScript for all components
- ALWAYS prefer composition over inheritance
- MUST include proper prop types
## Component Structure
No suspicious patterns detected.