Security audit
Security checks for vulnerabilities and agentic risk
This documentation-only skill reviews projects and creates advisory plans, but it does not install code, persist, or authorize changes by itself.
Install only if you want an agent to inspect project materials and give lifecycle, audit, and handoff recommendations. Treat generated implementation plans, task queues, or code snippets as advisory drafts that still require your explicit approval before another agent or engineer makes changes.
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
## Stage 1 — First-Round Mid-Project Review Questions
Do not judge yet. Start with:
# First-Round Mid-Project Review Questions
This section explicitly instructs the model to generate an AI Coding Agent development execution plan, including directory structures, data models, APIs, implementation tasks, and execution order. That exceeds the skill’s declared read-only audit/recommendation scope and can operationally enable code generation or project execution planning, undermining governance boundaries and increasing the chance of unauthorized implementation guidance.
The prompt explicitly instructs the model to generate implementation-ready fixes, code diffs, rollback steps, and execution guidance for engineers or an AI coding agent. That exceeds the skill's stated read-only audit boundary and can cause capability escalation from advisory analysis into actionable code-authoring/orchestration, increasing the chance of unsafe autonomous changes or governance bypass.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
4. establish which sources are current authority and which are history;
5. state the review boundary and missing evidence.
Do not ask the user for facts that can be discovered safely. Ask only questions whose answers materially change the recommendation. For a blank-slate idea, use a short first round of at most 6-8 questions. For an existing project, inspect first and ask a smaller gap-focused round.
## Startup Gates
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
1. **What is it** — one sentence of user pain, not a feature list.
2. **What it is not** — three explicit exclusions.
3. **What counts as done** — one sentence an outsider could check without asking you.
4. **How the MVP walks end to end** — the named steps of the primary user flow.
If any question is unanswered, the recommendation is `do not start yet`, not a softer plan. "We will figure out done later" is the single strongest predictor of scope creep.
The skill enables implicit invocation but provides only a broad, high-level description covering many loosely related triggers and project states. This increases the chance the agent will auto-activate in contexts where the user did not clearly request this audit skill, causing unsolicited repository inspection or lifecycle recommendations on sensitive project material.
The prompt materially exceeds the skill's declared read-only audit and bounded recommendation role by instructing the agent to perform solution design, recommend technical stacks, and prepare outputs usable by coding agents or engineers. This creates scope-confusion and capability escalation risk: a user invoking a supposedly governance-safe audit skill could receive implementation-oriented guidance that leads to unauthorized development planning or operational decisions outside the approved skill boundary.
This section explicitly instructs generation of an execution-ready development plan, including environment-variable setup, dependencies, data models, folder structure, API design, backend tasks, tests, and development order. In the context of a skill advertised as non-coding, non-governance-changing, and read-only, this is a direct contradiction that can bypass product-level safety expectations and turn an audit workflow into actionable build orchestration.
The prompt says the task is not to write code immediately, but the broader document later directs creation of implementation-oriented deliverables for engineers or coding agents. This mismatch is dangerous because it can mislead reviewers into treating the skill as planning-only while still producing actionable build artifacts that bypass the intended scope controls.
The prompt hard-locks the interaction into Chinese and explicitly requires Chinese-structured output without offering language negotiation or honoring the user's preferred language. In a multi-user or policy-sensitive agent environment, this can cause misinterpretation of safety-critical guidance, reduce user comprehension, and make downstream review or approval less reliable.
This markdown prompt is entirely written as a mandatory Chinese-language instruction set and does not indicate that the user may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.
This section instructs the model to produce a task queue specifically tailored for an AI Coding Agent, including sequencing, validation, acceptance criteria, and rollback guidance. In the context of a skill advertised as providing bounded recommendations without coding or self-authorizing work, this materially expands the skill into implementation orchestration and lowers the barrier to autonomous modification.
The file's natural-language instructions are entirely in Chinese, and there is no indication that users may opt into another language or that the skill is intentionally restricted to a Chinese-speaking locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The file presents the full policy in two languages, but it does not state whether the skill should respond in the user's preferred language or how language selection is determined. Under the language/locale policy rule, forcing or assuming a language without user opt-in can be a natural-language policy concern.
The file path and content indicate an English-only prompt variant, and the instructions throughout assume a single language output without asking the user for language preference. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.
No suspicious patterns detected.