Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent API testing guidance skill with defensive QA content and no evidence of hidden execution, persistence, exfiltration, or destructive behavior.
Install this if you want Chinese-language API testing checklists and templates. Use any generated security, load, webhook, or retry tests only against systems you own or are explicitly authorized to test, especially where real credentials, payments, or write operations are involved.
The activation trigger includes an overly broad condition equivalent to 'when API testing is needed,' which can cause the skill to activate for loosely related requests. In an agentic system, over-broad routing can expose unnecessary tools, produce unintended security-testing guidance, or override a more appropriate safer skill, increasing the chance of misuse or policy drift.
The when-to-use field repeats the same broad activation logic without boundaries, reinforcing over-selection of this skill. In practice, duplicate broad triggers make misrouting more likely and can lead the agent to provide security-testing or exploitation-adjacent workflows in contexts where the user did not clearly request them.
The file title and all instructional content are written entirely in Chinese, which imposes a specific language on the skill's use. There is no visible opt-in, alternative language option, or justification that this skill is intentionally region- or locale-specific.
The manifest description is primarily written in Chinese, with only a partial English sentence appended, and the rest of the skill content continues in Chinese. This can violate a language/locale policy if organizational guidance requires not forcing a language without user opt-in.
SQP-3 applies to all file types and covers natural-language policy issues such as forcing a specific language without user opt-in. This markdown file presents all instructions and checklists only in Chinese, with no indication of optional language support or a justified region-specific scope.
No suspicious patterns detected.
