Security audit
Security checks for vulnerabilities and agentic risk
This is a local clean-code audit skill with no executable payload or credential/network behavior, though its read-only wording should be clearer because it creates report/checklist files.
Before installing, expect the skill to read the code you ask it to audit and to create local report/checklist files in the workspace root. If you want strictly inline output, ask the agent not to write files. Non-Chinese users may also need to request the report in their preferred language because some bundled guidance is Chinese-first.
The summary presents the skill's core behavior and deliverable framing primarily in Chinese, while the document elsewhere is bilingual. For a natural-language skill, this can imply a default language policy without explicitly offering the user a choice of output language or locale.
The boundary statement says the skill only reads user-explicitly-specified local code files, but the instructions later require reading bundled assets and writing generated files. This broadens the effective file access and side-effect surface beyond what the user is told, undermining informed consent and creating policy/compliance ambiguity.
The skill repeatedly claims it is "read-only" and "never edits," yet later instructs the agent to write audit reports and copy a checklist into the workspace root. This mismatch can mislead users and platform policy checks about the skill's actual side effects, increasing the chance of unauthorized or unexpected file creation.
The embedded code sample hard-codes TZ = "Asia/Shanghai", and the surrounding markdown is written as a general audit sample rather than a clearly region-specific tool. This can violate language/locale policy because it imposes a locale setting without offering user opt-in or explaining why that locale is required.
The entire skill document is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.
The document declares lang="zh-CN", and all visible instructional content is written in Simplified Chinese. For a general clean-code checklist, this imposes a specific language/locale without any opt-in or explanation that the skill is region-specific.
No suspicious patterns detected.
