Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent project documentation helper that reads a codebase and can create documentation templates, with no evidence of hidden execution, persistence, exfiltration, or privilege escalation.
Install only if a Chinese-language project documentation workflow fits your team. For private repositories, keep analysis local where possible and confirm before using web search, especially if search terms would include internal project names, private module names, endpoints, or security-sensitive architecture details.
声明的核心用途是‘分析代码库并生成定制化文档系统’，其中重点在文档产出。实际代码只是一个分析脚本，基于项目中的 package.json、pom.xml、requirements.txt、目录遍历和简单字符串匹配，提取技术栈与结构信息，输出分析 JSON。代码没有任何模板生成、文档写入、目录大纲生成、API 提取、架构说明生成等逻辑。因此其实际行为仅覆盖了声明中的‘分析代码库’前半部分，未覆盖主要承诺的文档系统生成能力，属于描述与行为的实质性不一致。
声明描述的是一个面向代码库的文档生成/补全文档技能，核心能力应是分析项目并产出文档体系。实际代码并未解析代码库、识别项目特点或生成文档，而是验证 Markdown 中 PlantUML 代码块的语法和复杂度，输出校验结果与拆分建议。虽然拆分建议与文档中的 UML 图维护略有关联，但这只是一个狭窄的文档辅助校验脚本，主目的与声明严重不符，因此应判定为明显不匹配。
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
pom.xml 关键依赖识别:
<!-- Spring Boot -->
<dependency>
<groupId>org.springframework.boot</groupId>
→ Spring Boot 框架
The skill clearly instructs reading the repository and generating documentation, and it references writing artifacts such as README.md and docs content, yet it declares no explicit tool scope or allowed-tools boundaries. In an agent environment, missing scope declarations can permit broader-than-expected file access or writes, making accidental modification or over-collection of project data more likely.
The manifest description and the document content present the skill in Chinese only, with no indication that users may choose another language. This can violate language/locale policy when a skill effectively forces a specific language without explicit user opt-in or documented regional justification.
The skill explicitly encourages on-demand web searches while also performing broad codebase exploration, but it provides no privacy guardrails about sending repository-derived terms, internal module names, or sensitive technology details to external services. In private or proprietary repositories, this can leak confidential architecture, product names, endpoints, or security-relevant metadata outside the local environment.
该 markdown 文件整体以中文编写，并在示例与模板中默认要求中文标题、说明和受众描述，但未说明这是面向中文团队的区域性文档标准，也未提供语言选择或可本地化选项。根据规则，未经过用户选择而强制单一语言属于自然语言层面的策略违规。
The file’s natural-language documentation and identifiers describe the skill entirely in Chinese, including the module docstring and class docstring. This imposes a specific language/locale choice in the skill text without offering the user a language option or documenting a justified region-specific constraint.
The document title and subtitle are presented only in Chinese, and the rest of the file consistently provides instructions in Chinese without indicating that other languages are supported. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified.
This markdown file presents all instructions and examples exclusively in Chinese, and there is no indication that users may choose another language or that the skill is intended only for a Chinese-speaking or region-specific context. The stated policy flags language or locale constraints when a skill effectively forces a specific language without user opt-in.
This code file contains user-facing natural-language descriptions and messages only in Chinese, such as the module docstring and CLI/help text, with no indication that the user can select another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
This is a natural-language policy issue because the file forces a single locale for core usage instructions and output labels. The script does not offer an English alternative, locale selection, or any explanation that it is intentionally region-specific.
Argument descriptions, examples, status text, and summary output are all presented only in Chinese. For a general-purpose validation script, this constitutes a language-policy concern unless users can choose their preferred language or the locale limitation is explicitly justified.