Security audit
Security checks for vulnerabilities and agentic risk
This is a release-risk planning skill with no executable payload; the main caution is an optional unpinned npx install suggestion for a larger skill set.
Before running the optional npx install command for the broader skill set, review the source and prefer a pinned, trusted version. The skill itself is suitable as release-planning guidance, but users should keep actual production release and rollback execution behind normal approvals.
In this markdown skill description, the trigger list includes generic phrases such as "风险评估", "版本发布", and "紧急发布", which can overlap with many ordinary conversations about releases rather than specifically invoking this skill. The file does not provide negative examples or explicit scope limits to clarify when this skill should not activate.
The skill recommends installing and executing a package via npx skills without pinning an exact version or otherwise constraining the source. That creates a supply-chain risk: a future malicious or compromised package version could be fetched and run implicitly by users following the instructions.
This markdown file presents all operational guidance exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the locale restriction is intentional. Under the policy rule for language or locale constraints, forcing a single language without user opt-in is a policy concern.
