Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward code-analysis helper with an optional dependency-graph command, and I found no hidden, destructive, exfiltrating, or persistent behavior.
Before installing, understand that this skill is optimized for Chinese-language explanations and may suggest running a local Node script to generate dependency graphs. Only run that command in a trusted project after checking the referenced script, but the inspected package itself contains only markdown instructions.
The instruction says all text, node names, and arrow labels in diagrams '必须用中文', which imposes a specific language regardless of the user's preference. This is a natural-language policy issue because the skill does not offer a language choice or document a justified locale restriction.
The skill explicitly instructs invoking a local shell command to run a Node.js script, which expands the skill from passive code explanation into operational command execution. In an agent setting, this creates a real risk that untrusted repositories or manipulated environments could cause the agent to execute unintended code or normalize unnecessary tool use during analysis.
No suspicious patterns detected.
