Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local clean-code audit guide that reads user-selected source code and writes disclosed report/checklist artifacts, with no evidence of hidden network, credential, persistence, or destructive behavior.
Install only if you want an agent to inspect local source files you point it at and create audit artifacts in the workspace. Review the generated report/checklist paths if you care about workspace file clutter or checklist overwrite behavior.
This markdown file explicitly lists trigger phrases including "clean code audit" and "audit my skill scripts," then says "or any trigger," without defining clear boundaries or negative examples. Those phrases are broad enough to match ordinary user requests about code review, making activation scope ambiguous.
The embedded code sets TZ = "Asia/Shanghai", which forces a specific locale-related setting in natural-language-visible content without any opt-in, alternatives, or documented regional justification. The surrounding markdown does not explain that this is intentionally region-specific, so it presents a language/locale policy concern.
This markdown file is written entirely in Chinese, including the title and all operational guidance, with no indication that the user can choose another language or that the skill is intentionally region-specific. That creates a natural-language locale policy concern because the skill effectively imposes a language on users without opt-in.
The natural-language metadata states 语言 / lang: zh and 模式 / mode: auto→zh, which indicates the skill defaults or forces Chinese output. The file does not present this as an opt-in choice for the user or justify it as a region-specific requirement, so it conflicts with the language/locale policy criteria.
This code emits user-facing messages in a fixed Chinese/English bilingual format, including error text and normal output, rather than offering a language selection or documenting a justified locale constraint. That creates a natural-language policy concern because the skill imposes a specific locale presentation on all users without opt-in.
Line L47 says README was changed to Chinese plus English sections and SKILL.md titles gained English subtitles for international platforms. In isolation, this suggests a language presentation decision that may force a specific default language before the later changelog entries introduce explicit language selection, which can conflict with locale-choice policy expectations.
The document declares lang="zh-CN", and the visible UI text is entirely Chinese, which indicates a fixed language/locale choice. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative or choice is presented.
This markdown file embeds a code snippet whose stated behavior includes writing a summary JSON, but the surrounding documentation does not warn readers about modifying local files. For markdown files, omissions around data-affecting behavior should be disclosed when the described behavior can write or alter user-visible artifacts.
This markdown file consists entirely of Chinese-language instructional content and does not indicate that the user can choose another language. Under the language/locale policy check, forcing a specific language without user opt-in is a natural-language policy concern.
