Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation workflow skill that writes project spec files and coverage metadata, with no hidden execution, credential use, network retrieval, or system persistence found.
Install this if you want a strict Traditional Chinese workflow for maintaining software specs and coverage files. Expect it to steer documentation structure strongly and to pause feature coding when required FR/AC entries are missing.
The skill mandates a specific output format choice without user opt-in, which can conflict with user preferences or project conventions and reduce agent reliability. While this is not a direct security exploit, it is a policy-overreach pattern that can cause unexpected behavior and make downstream interactions harder to control.
The skill's activation criteria are extremely broad, triggering on common terms like 'spec', 'document', 'coverage', or even when code is about to be written without an obvious spec. This can cause the skill to activate in many unrelated contexts, effectively overriding normal task routing and steering the agent into this workflow when the user did not clearly request it.
This markdown file is written entirely in Traditional Chinese and does not indicate that language choice is optional or limited to a justified region-specific context. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is in scope.
The title and the entire document prescribe writing conventions in Traditional Chinese, but there is no indication that users may choose another language or that the constraint is limited to a region-specific context. This creates a natural-language locale policy issue because the skill appears to force a specific language without opt-in.
This markdown file contains user-facing instructions exclusively in Chinese, and nowhere indicates that the user may choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the language/locale policy rule, forcing a specific language without opt-in is a natural-language policy violation.
This markdown file presents the skill documentation entirely in Traditional Chinese and frames it as the default reference for team members, but does not offer any language choice or indicate that Chinese is an explicit user-selected or region-specific requirement. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.
This manifest/template contains user-facing instructional text exclusively in Traditional Chinese, including operational rules and status definitions. The file does not indicate that language selection is optional or justified as a region-specific requirement, which can violate the language/locale policy for natural-language content.
No suspicious patterns detected.
