Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed HTML review-and-iteration workflow, but users should be aware it sends selected files through Feishu and creates new versioned HTML files.
Install this only if you are comfortable with an agent sending the selected HTML file and the generated result through Feishu. Before running it, confirm the file path, Feishu target, and new version filename, especially if the project directory may contain sensitive or private files.
The trigger list includes broad phrases like “代码评审流程” and “自动迭代改进,” which can match ordinary user requests and cause the skill to activate outside its intended scope. Because this skill performs consequential actions such as sending files and initiating workflows, overbroad activation increases the chance of unintended data handling or file operations.
The workflow instructs the agent to send a user-specified file through Feishu without requiring an explicit warning, destination confirmation, or sensitivity check. In context, this is more dangerous because the skill is designed to automate file transmission, so accidental activation or ambiguous user input could lead to unintended exfiltration of local or sensitive files to an external channel.
The skill directs creation of a new versioned file but does not warn the user that it will modify the filesystem. While this appears intended for normal workflow automation, silent file creation can still overwrite expectations, clutter directories, or be combined with ambiguous activation to make unauthorized local changes.
No suspicious patterns detected.
