Security audit
Security checks for vulnerabilities and agentic risk
This is a coding-practice tutoring skill with some broad auto-activation and optional Feishu export behavior users should notice before using.
Installers should expect this skill to take over many coding-related prompts because its activation terms are broad. Use care with the Feishu archive feature: review the generated notes and confirm the destination before uploading anything sensitive to a shared team document space.
The activation keywords are extremely broad and overlap with ordinary programming discussions such as '代码', 'C++', '题目', and '思路'. This can cause the skill to auto-activate unintentionally in unrelated conversations, leading to unsolicited instruction injection, incorrect workflow takeover, or unexpected handling of user content under the skill’s rules.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# ==============================
# 算法竞赛全能刷题助手 Skill
# 存放路径：.workbuddy/skills/code-helper/SKILL.md
# 适配人群：计算机大一新生、蓝桥杯/洛谷入门选手
# 支持：C/C++代码、题目解析、错因排查、性能优化、文档导出、知识点总结
# ==============================
The skill advertises one-click Feishu document export/archive but provides no warning that user content may be transmitted to an external service and stored persistently. Users may unknowingly send problem statements, notes, or potentially sensitive content outside the current environment without informed consent.
The archive command specifically directs storing notes in team Feishu documents but lacks any safety warning about external transmission, organizational visibility, or long-term retention. In a collaborative workspace, this increases the risk of accidental disclosure of user-generated content to broader audiences or systems beyond the user’s expectation.