Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Java/Maven unit-test generator; its repository reads, git checks, Maven commands, and optional pom.xml edits fit that purpose.
Install this if you want an agent to inspect a Java/Maven repository and generate or update JUnit 5 plus Mockito tests. Expect it to read relevant source files, run git and Maven checks, create test files, and ask before changing pom.xml dependencies. Users who do not want Chinese-language guidance or broad test-generation activation may prefer a narrower or bilingual version.
The README presents the skill's purpose, features, and activation instructions entirely in Chinese, which can impose a specific language on users without opt-in. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.
The activation examples are broad enough that the skill may trigger for ordinary requests about writing or improving Java tests, not just for its intended scoped use. Over-broad activation can cause unintended tool selection, unnecessary repository inspection, and execution of git/maven-related behaviors in contexts where the user only wanted lightweight guidance.
The skill description and frontmatter are broad enough to trigger on generic test-generation requests, not just the intended incremental Java/Maven use case. This can cause the agent to invoke the skill in inappropriate contexts, leading to unintended file inspection, git diff analysis, pom.xml modification suggestions, or Maven command execution paths that exceed the user's actual request.
The keyword trigger list contains vague phrases like 'generate tests' and '提高测试覆盖率' without scope guards, making accidental activation likely across unrelated languages, frameworks, or high-level advisory requests. In this skill, accidental activation is more concerning because the workflow instructs repository scanning, branch comparison, dependency checks, and possible pom.xml modification, which can steer the agent into over-broad project actions.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all instructions and warnings only in Chinese, with no indication that the skill is region-specific or that users may opt into another language.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown reference forces a specific language for all instructions and examples, and there is no indication that the skill is region-specific or that users can opt into another language.
No suspicious patterns detected.
