Security audit
Security checks for vulnerabilities and agentic risk
This programming helper is not malicious, but it needs review because it can broadly auto-route coding requests and persist or export project, code, review, and debugging information without clear opt-in controls.
Install only if you are comfortable with a stateful development assistant. Before use, require confirmation for project-memory writes, local report files, and any Notion export; keep secrets, customer data, raw logs, and proprietary code out of persisted summaries unless explicitly approved and redacted.
The README is presented entirely in Chinese and the skill identity is labeled in Chinese without any indication that users may choose another language or locale. For a general-purpose programming assistant serving broad software teams, this may constitute a language-policy issue if users are not given an opt-in or choice.
Many listed triggers are extremely generic, such as terms equivalent to 'SQL', 'README', 'debug', 'spec', or 'implement functionality', which are likely to appear in ordinary conversation without the user intending to invoke a specific skill. This creates prompt-routing ambiguity and increases the chance of unintended execution paths, especially in a package that includes code generation, deployment, review, and persistent project memory behaviors.
The README states that users can 'naturally trigger' skills and have them automatically matched, but it does not define strong boundaries, disambiguation rules, or confirmation requirements. In a multi-skill coding assistant, overly broad natural-language activation can cause the wrong skill to run, leading to unsafe guidance, unexpected memory capture, or inappropriate handling of sensitive development and deployment tasks.
The top-level trigger phrases are extremely broad and overlap with ordinary software-help requests, making accidental invocation of this umbrella skill likely. In an agent setting, that increases the chance the model loads a powerful orchestration skill and follows file-reading/writing workflows the user did not explicitly request.
The routing logic relies on ambiguous scenario matching and only partially resolves conflicts, so multiple subskills may match the same prompt without deterministic safety-first handling. This can route users into templates with stronger operational behaviors, including reading references and producing files, even when a narrower or safer interpretation would be appropriate.
The skill explicitly permits writing files as outputs but does not require prior user consent, scope restriction, or a dry-run summary before modification. In agent environments, that can lead to unintended workspace changes, overwriting files, or creating artifacts the user did not realize would be written.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 路由表
| 子技能 | 功能说明 |
| ---------------- | -------------------------------------------------------------------------------------------------------------- |
| 软件项目总控 | 通用软件项目从需求到交付的总控：边界、行为契约、架构、数据/API/集成、测试、安全、发布、回滚和沉淀。 |
| 网站项目总控 | 从需求到上线的建站项目总控：站点规划、内容SEO、前端设计、CMS/API/数据、测试安全、性能部署、验收运维。 |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 子技能索引
| 子技能 | 英文标识 | 文件 |
| ---------------- | ---------------------------------- | -------------------------------------------------------------------------------------------------- |
| 软件项目总控 | `software-project` | [references/software-project.md](./references/software-project.md) |
| 网站项目总控 | `website-project` | [references/website-project.md](./references/website-project.md) |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
本技能原有四步流程（意图识别→加载模板→按模板执行→输出结果）映射到六步闭环：
| 闭环步骤 | 对应本技能环节 | 具体动作 |
| ----------- | -------------------------- | ----------------------------------------------------------------------------------------- |
| 1. 分析指令 | Step 1: 意图识别与路由匹配 | 提取用户需求中的目标、范围、技术约束；标注不确定信息；判断子技能匹配度 |
| 2. 制定方案 | Step 2: 加载子技能模板 | 根据子技能索引读取模板；确认输入要求、执行步骤、输出格式；定义验收口径 |
This markdown skill specifies its title and all operating instructions in Chinese, which effectively forces a specific language for users. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.
The skill instructs persisting bug root causes, fixes, and preventive measures into a project memory system, which extends the skill from diagnosis into data retention and external state modification. Debugging artifacts often contain stack traces, file paths, secrets, customer data, or proprietary code details, so automatic recording creates an unnecessary disclosure and persistence risk if done without explicit user approval and minimization.
The skill directs storage of bug reports and fixes in project memory and references external systems, but does not warn users that debugging inputs may contain sensitive information. This omission increases the chance that stack traces, source snippets, database details, or customer data will be stored or shared unintentionally.
The fallback path tells the skill to output a Decision Record to a local file, adding file-write behavior beyond the stated diagnostic purpose. Writing bug reports locally can leak sensitive logs, credentials, internal paths, or exploit details onto disk where retention, access control, and cleanup are undefined.
The instruction to write a Decision Record to a local file lacks any warning about sensitive data being written to disk. In debugging contexts, this can persist confidential technical or customer information in places that may be backed up, synced, or accessible to other users or processes.
The optional Notion connector enables writing diagnosis reports and fixes to an external knowledge base, which is unrelated to core bug diagnosis and expands the data exfiltration surface. Because debugging content frequently includes sensitive operational and code information, pushing it to third-party systems without explicit consent or scoping can expose confidential data.
The line explicitly requires comments to be in Chinese (注释 | 中文), which is a natural-language policy constraint. The document does not provide a user choice, opt-in, or justification that this is a region-specific requirement, so it fits the language/locale policy violation category.
The entire skill specification is presented only in Chinese and does not state that the user may choose another language or locale. Under the policy for natural-language constraints, forcing a specific language without user opt-in is a locale/language policy concern.
The skill’s stated purpose is code generation, but this step instructs the agent to persist implementation decisions and newly discovered conventions into a project memory system. That expands the trust boundary from local code synthesis to data retention and possible cross-session reuse, which can leak sensitive design details, credentials accidentally present in prompts, or proprietary project context if memory is shared or insufficiently scoped.
The optional connector section authorizes writing generated code and design documents into Notion, which is an external publication action beyond core code generation. Without explicit consent and data handling controls, this can exfiltrate proprietary source, internal architecture, or sensitive business information to a third-party service.
This capability enables the agent to write generated artifacts to Notion even though that behavior is not necessary to fulfill code generation. Unnecessary write capabilities increase attack surface and create opportunities for unintended disclosure, especially when generated outputs may embed confidential requirements, API details, or internal documentation.
The skill goes beyond passive code review guidance by instructing the agent to persist findings and norms into a project memory system. In an agent environment, this creates an external state-changing side effect that may store sensitive code details, vulnerabilities, or internal conventions without explicit user approval, increasing data leakage and cross-session contamination risk.
The fallback mechanism explicitly permits writing review results to a local file when the memory system is unavailable. This introduces an undeclared write capability in a skill that is presented primarily as a review/reporting tool, which can persist sensitive source code analysis or security findings onto disk without clear authorization.
The skill describes capabilities to write reports to local files and external systems but does not provide an upfront warning in the main skill description or usage contract. This lack of transparency undermines informed consent and makes unintended persistence or disclosure of sensitive review content more likely in normal use.
Advertising a Notion connector that can write review reports and remediation lists to an external knowledge base gives the skill a broader exfiltration/write surface than implied by a code-review function. Because code review output can contain proprietary code fragments, secrets, vulnerabilities, or architecture details, pushing it to third-party systems can materially increase confidentiality and compliance risk.
The skill’s declared purpose is document generation, but it also instructs the agent to persist decisions into project memory, which expands scope from content generation to stateful data retention. This is dangerous because it can cause unintended storage of sensitive implementation details, design rationale, or user-provided content without explicit consent or clear minimization rules.
No suspicious patterns detected.