Security audit
Security checks for vulnerabilities and agentic risk
This is a read-only code review skill that inspects repository diffs and files to produce review findings, with no evidence of hidden execution, persistence, or data exfiltration.
Before installing, understand that saying "review" may trigger a branch-level code review and cause the agent to read changed files and relevant context in the repository. Use an explicit range such as "review origin/main..HEAD" if you want tighter scope.
The documented triggers are broad enough that common conversation like 'review' or 'code review' could invoke the skill unintentionally. In an agent environment, unexpected activation can cause the agent to inspect repository state or launch subagents without explicit user intent, increasing the chance of unintended data access or disruptive behavior.
The usage text hard-codes a non-English trigger phrase ("审查") alongside English triggers without explaining language selection or user preference handling. This can create a locale-policy concern if the skill assumes or enforces specific language triggers without explicit opt-in or language choice.
The skill says it triggers when the user says "review" or after completing a feature, both of which are broad enough to overlap with common conversation and many contexts unrelated to code review. Although some exclusions are provided, the trigger scope is still not specific enough to clearly distinguish when the skill should or should not activate.
The instruction to 'scan key files' in combination with default branch-wide review and git-diff resolution encourages broad repository inspection beyond the minimum necessary user-scoped input. In an agent setting, this can lead to unnecessary file system enumeration and exposure of sensitive code, configs, or secrets present elsewhere in the working tree when the user's request did not explicitly authorize that breadth.
### Phase 1: Rapid Scan (read diff surface → Overview)
Read the diff summary for the resolved range, scan key files. Form an opinion on:
- **What actually changed** vs what was planned
- **Design alignment**: do class hierarchies make sense? does DI flow consistently?
- Any obvious red flags from the diff alone
The description explicitly includes the Chinese trigger term "审查" alongside English triggers, which constitutes a language-specific activation rule. The file does not explain locale scope, user opt-in, or whether multilingual behavior is optional, so this can be a language/locale policy concern.
Line L082 states the subagents 'share no state', but later lines L108-L110 describe coordinated execution and post-processing of both outputs into a merged issues list. While the underlying review remains read-only, the documentation overstates isolation in a way that conflicts with the actual described workflow.
No suspicious patterns detected.