Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent self-improvement/logging framework, with disclosed workspace recordkeeping but no executable code, exfiltration, privilege escalation, or hidden behavior found.
Install only if you are comfortable with a Chinese-language skill that may write growth history, logs, and periodic reports in the workspace. Avoid using it on sensitive projects unless you can control what gets recorded and where those records are retained.
The skill description is presented entirely in Chinese, which implicitly requires users to read and interact in that language. The file does not offer a language choice, translation option, or state that the skill is intentionally region-specific, so it may violate language/locale policy requirements.
The skill explicitly promotes persistent logging, growth history retention, and writing reports such as LEARNINGS.md and growth_reports/evolution_{round}.json, but it does not warn users that workspace data will be stored across runs. In an agent setting, these logs may capture sensitive prompts, task history, internal reasoning summaries, operational metrics, or project context, creating privacy, retention, and inadvertent data disclosure risks.
The verification protocol content is written entirely in Chinese, including headings, checklist items, and evaluation criteria, with no indication that users may choose another language or that the skill is intended only for a Chinese-language context. This creates a natural-language policy concern because it imposes a specific language on users without opt-in.
The headings and operational instructions are presented only in Chinese, which can force a specific language on users or operators without opt-in. The file does not indicate that this skill is region-specific or provide an alternative language option.
The natural-language instructions and descriptions in the skill are presented only in Chinese, while the manifest does not indicate that the skill is intended exclusively for Chinese-speaking users or a China-specific context. This can violate language/locale policy expectations when users are not given an explicit language choice or opt-in.
No suspicious patterns detected.
