Security audit
Security checks for vulnerabilities and agentic risk
This is a simple code performance profiling skill with no evidence of hidden access, persistence, network use, or destructive behavior.
Install this only if you want a lightweight performance-analysis helper. Non-Chinese users may find the documentation and suggestions unclear, and administrators may want narrower trigger phrases before publishing broadly.
The skill description is written only in Chinese and does not indicate language options or a justified locale restriction. This can cause misrouting, user confusion, or inaccessible behavior for users operating in other languages, which is a quality and safety concern because it may lead to incorrect invocation or misunderstanding of the skill's scope.
The trigger phrases include very broad terms such as "performance" and generic optimization wording, which can cause the skill to activate in contexts where the user did not intend to invoke a profiler. Unintended activation can lead to irrelevant guidance, routing errors, or interference with more appropriate skills, though it does not by itself enable direct code execution or data exfiltration.
The trigger patterns are broad and mix generic English and Chinese terms such as 'performance' and '优化建议', which can cause the skill to activate in contexts far beyond explicit profiling requests. This increases the chance of unintended invocation, unnecessary exposure of user code to the skill, and downstream misrouting or over-collection in multi-skill environments.
The skill description and suggestions are written only in Chinese without any documented locale restriction or language negotiation, which can cause incorrect interpretation, hidden behavior from non-Chinese reviewers, or poor user understanding of what the skill will do. While not directly enabling code execution or data exfiltration, this reduces transparency and can contribute to unsafe invocation or misuse.
No suspicious patterns detected.
