Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple local code-pattern vulnerability scanner with no evidence of hidden execution, persistence, credential access, or data exfiltration.
This skill appears safe to install for local, pattern-based code review, but users should know it is lightweight and may produce false positives or miss real vulnerabilities. The publisher should narrow the generic "vulnerability" trigger and document language behavior more clearly.
The natural-language description and feature list force a specific language for user-facing behavior, but the file does not offer user opt-in or explain that the skill is intentionally region- or locale-specific. This can violate language or locale policy requirements for user choice.
The trigger phrase "vulnerability" is extremely broad and can match many unrelated user requests, causing this skill to activate outside its intended scope. Over-broad activation can lead to accidental invocation, context hijacking, or interference with other more appropriate skills, especially in multi-skill agent environments.
The trigger pattern list includes the generic English term "vulnerability", which is broad enough to match many unrelated user requests and cause the skill to activate unexpectedly. Because this skill performs security analysis, unintended invocation could lead to incorrect routing, confusing results, or exposure of user-supplied code to a skill they did not explicitly intend to use.
The natural-language trigger section includes both Chinese and English phrases, but the file does not explain language selection behavior or whether invocation is limited to particular locales. This can create an implicit language policy without an explicit user-facing choice or documented justification.
No suspicious patterns detected.
