Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed coding-workflow standards guide with broad activation language, but it does not install code, persist itself, exfiltrate data, or secretly expand privileges.
Install this if you want stricter coding workflow discipline. Expect it to activate on many development-related requests and to add planning, verification, rollback, and checklist steps; review whether that extra process fits your workflow.
The top-level trigger description is broad enough to activate on many normal coding-related requests, which can cause this skill to take over interactions outside the user's intended workflow. In a routing skill, overbroad activation is dangerous because it can impose extra process constraints, alter agent behavior, and create unauthorized scope changes in how tasks are handled.
The scenario trigger lists include highly generic terms such as 'implement', 'error', 'fix', and 'optimize', which frequently appear in ordinary developer conversations without meaning the user wants this orchestration skill engaged. This increases the chance of false activation, causing the agent to follow rigid workflow instructions and potentially override the expected handling of unrelated requests.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Skipping think-then-code**: The most common mistake under vague requirements. You MUST write down your understanding and approach BEFORE writing any code. No exceptions.
- **Over-engineering**: Introducing abstraction layers when there's only one implementation. Violates Simplicity. It increases maintenance cost, not reduces it.
- **Drive-by refactoring**: "While I'm here" refactoring during a bug fix or feature. Violates Surgical Changes. It introduces uncontrolled risk.
- **No verification instructions**: Ending a task after writing code. Violates Goal-Driven. The user CANNOT confirm the fix works.
- **Hardcoded env config**: Embedding config values or paths in code. It WILL break in deployment. ALWAYS use env vars.
## Verification
The trigger 'all other bugs not matching the specialized types above' is effectively a catch-all without concrete boundaries or negative examples, making activation broad and ambiguous. In a reference skill, this can cause unintended invocation whenever a bug report does not clearly fit another bucket.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
**Hard Constraints**:
- You MUST list every file and module affected BEFORE making changes. NEVER expand scope beyond what's listed.
- New DB fields MUST include default values and migration plan. NEVER add a column without a migration.
- You MUST reuse existing components and APIs. NEVER duplicate logic that already exists in the codebase.
The deploy trigger list contains broad words like 'release' and 'ship' that are commonly used metaphorically or in planning discussions, not only for actual deployment intent. In this skill context, that can misroute a harmless discussion into a deployment workflow with unnecessary operational assumptions and steps.
Activation phrases throughout the file are specified in Chinese and English only, which imposes a language-specific trigger scheme without stating that language selection is configurable or intentionally limited. This can conflict with language/locale policy requirements where user opt-in or documented justification is expected.
No suspicious patterns detected.