Security audit
Security checks for vulnerabilities and agentic risk
This skill reads user-provided PRD documents and guides an agent through a PRD review workflow without evidence of hidden, destructive, persistent, or exfiltrating behavior.
Install this if you want a Chinese-language PRD review helper. Only provide PRD files you intend the agent to read, since the parser will print extracted document text into the session for analysis.
声明描述的是一个高层PRD审查与设计要点整理工具，核心能力应包括内容理解、逻辑分析、要点抽取、优先级判断和结构化输出。但提供的代码只负责从多种文档格式中提取文本，属于前置的文档读取/解析功能，并未体现任何审查、分析、分类、优先级评估或标准化结果生成逻辑。虽然文档解析可作为该技能的支持性实现细节之一，但当前代码块的主要目的与声明的主要功能存在明显差距，因此应判定为描述与实际行为不匹配。
The skill instructs the agent to read local files via scripts/doc_parser.py and direct document handling, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent may access local files more broadly than intended, especially if a user supplies unexpected paths or sensitive documents.
This markdown file is natural-language guidance and begins with a Chinese-only title, with the rest of the document also written in Chinese. Under the policy rule, forcing a specific language without user opt-in or documented justification is a locale/language policy concern.
The description and trigger section say the skill should be used when a user needs to review a PRD, extract design points, prioritize design work, or quickly coordinate with development. While PRD review is domain-specific, the activation scope is still open-ended because it does not clearly distinguish qualifying PRD-review requests from adjacent design-analysis or development-coordination requests, nor does it provide negative examples.
The module description and all user-facing usage/help strings are written only in Chinese, which imposes a specific language on users without opt-in. Under the policy, language constraints should either offer a choice or be explicitly justified as region-specific.
No suspicious patterns detected.
