Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only programming workflow skill with no evidence of hidden execution, exfiltration, destructive behavior, or privilege escalation.
Install only if Chinese-language workflow instructions are acceptable for your team. Treat the heartbeat and CI/CD language as guidance that should remain user-triggered or explicitly scheduled by your own tooling, and review any generated code, project documentation, or deployment changes before applying them.
The section labeled "心跳触发" describes broad conditions such as checking for new debug records or CI/CD failures, but it does not define what event actually invokes the skill, how often it runs, or what counts as "new" or in-scope. Without explicit trigger phrases, scope constraints, or exclusion conditions, the skill could be invoked more broadly than intended.
All user-facing instructions in this file are written in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language context. This can violate language/locale policy when a specific language is imposed without user opt-in.
The file’s primary description forces a specific language presentation for users, and the rest of the document continues in Chinese without any opt-in or alternative locale. This can violate language/locale policy because users are not given a choice and no region-specific justification is provided.
The verification protocol is written entirely in Chinese, including all operational checklist items and pass criteria, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can constitute a language/locale policy violation because it imposes a specific language by default.
The primary skill description is written entirely in Chinese and does not indicate that other languages are supported or that the user can choose a preferred language. Under the policy, language-specific behavior should be opt-in or clearly justified as region-specific.
