Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only domain-modeling skill that asks the agent to read local requirement context and produce state, data-flow, and service-dependency models.
Install only if you want a Chinese-oriented QA domain-modeling helper. Review the optional npx command before running it, because it installs a broader skill set from the current remote package state.
The description contains broad trigger phrases such as requests about state machines, data flow, modeling, and complex requirements without clear boundaries or exclusions. Over-broad activation can cause the agent to invoke this skill in unrelated contexts, which may misroute workflows, override more appropriate skills, or expand access to documents unnecessarily.
The primary natural-language instructions and trigger definitions are written in Chinese, which can effectively impose a language expectation on usage without explicitly offering a language choice. The file includes one English sentence, but it does not clearly state that users may interact in their preferred language.
The when-to-use field repeats expansive activation conditions and lacks exclusion logic, making automatic or heuristic invocation more error-prone. In agent systems, ambiguous routing can lead to unintended context loading, wasted tokens, and incorrect outputs being generated under the wrong skill assumptions.
The skill includes an installation command using npx skills without pinning a specific package version or integrity source. This can cause users to fetch whatever version is current at execution time, increasing supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly.
