Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward code review checklist helper with no hidden data access, persistence, network use, or destructive behavior.
Installers should expect a generic checklist assistant for code reviews. It may trigger on broad code-review or code-quality requests and is mostly oriented around English output with Chinese trigger examples, but it does not request sensitive access or perform actions on code by itself.
The description explicitly targets requests such as '代码审查、代码检查' and later usage examples are predominantly in Chinese, but the skill does not state that language selection is optional or that the skill is region/language-specific. This can amount to a language/locale policy issue because the skill appears to bias invocation and use toward a specific language without user opt-in.
The intent detection logic explicitly recognizes only Chinese and English keywords across multiple branches, which embeds a language constraint into the skill's behavior. Because the file does not offer user opt-in, fallback messaging about supported languages, or any documented region-specific justification, this can violate a language/locale policy requiring neutrality or user choice.
The description activates on very broad terms such as code review, code quality, and PR review without clear scope boundaries, which can cause the skill to trigger in loosely related contexts. Overly broad activation can route users into this skill unexpectedly, increasing the chance of inappropriate handling, prompt collisions, or misuse in contexts where a narrower skill should apply.
Detected: suspicious.dynamic_code_execution
