Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese-language analysis workflow that uses search, optional simulation, optional critic review, and a small persistent memory for recurring weaknesses, with privacy controls worth checking before use.
Before installing, be aware that this skill may search the web, run local Python simulations for prediction tasks, spawn a critic subagent for research-style analysis, and keep cross-session critique memory in /workspace/ask-memory.db. Avoid using it with sensitive personal or business judgments unless you are comfortable with that local memory behavior or have a way to clear or disable it.
The skill description and operating instructions are entirely in Chinese and present the framework as fixed to that language, with no user opt-in or alternative locale handling. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
The skill declares persistent cross-session SQLite storage for '批评记忆' but does not clearly warn users at runtime that their interaction-derived information may be retained across sessions. Persistent memory creates privacy and data-governance risk, especially when the skill also performs analysis and may store sensitive weaknesses, user prompts, or derived judgments without clear consent, retention limits, or deletion controls.
The skill auto-triages based on very broad everyday phrases like '今天', '现在', and '查一下', which can cause unintended invocation of search-heavy or analysis behavior when the user did not explicitly request it. In a skill with web search, Python execution, subagents, and persistent memory, overly broad triggers increase the chance of unnecessary external actions, data exposure to tools, and confusing escalation of capability.
No suspicious patterns detected.
