Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent data-warehouse assistant, but its metadata collection guidance can overreach into broad database, API, web, or HDFS metadata using sensitive credentials.
Install only if users understand this is for a Chinese-language data warehouse environment. Require explicit table allowlists or explicit approval before any whole-database or recursive metadata collection, use HTTPS only, provide read-only scoped credentials through protected secret mechanisms, and avoid pasting live cookies or passwords into generated files or chat.
resources/conventions/metadata-config.md:40Metadata Collection Defaults Permit Excessive Database and Filesystem Enumeration
resources/conventions/metadata-config.md:115Metadata Collection Guidance Allows Insecure Transport and Plaintext Web Credentials
Referenced artifact was not completely inspected
- **规范缺失时主动询问并更新**：公约文件未明确记录的能力或规范，必须询问用户确认，不得臆想；确认后补充到对应公约文件（平台能力 → `platform-conventions.md`，团队约定 → `project-conventions.md`）
Referenced artifact was not completely inspected
- **规范缺失时主动询问并更新**：公约文件未明确记录的能力或规范，必须询问用户确认，不得臆想；确认后补充到对应公约文件（平台能力 → `platform-conventions.md`，团队约定 → `project-conventions.md`）
The manifest description and all user-facing instructions in SKILL.md are written entirely in Chinese, with no indication that users may choose another language. Under the policy, a skill that effectively enforces a specific language without opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
Line L125 states that all fields must use Chinese descriptions, which is a natural-language locale requirement. The file does not offer user opt-in or explain that this convention is limited to a justified region-specific or compliance-specific context, so it appears to force a specific language.
This markdown template is written entirely in Chinese and labels itself as a standard template, which implies a fixed language requirement for skill/task documentation. Under the stated policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
The file is entirely written in Chinese and explicitly states that this file is the only authoritative source for metadata collection method definitions. This can constitute a language policy issue because it forces a specific language for operational use without documenting any user choice, opt-in, or locale justification.
This markdown file contains natural-language instructions and conventions, and the title immediately shows the document is written in Chinese only. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in or a documented justification is a policy violation.
No suspicious patterns detected.