Security audit
Security checks for vulnerabilities and agentic risk
This is a transparent problem-solving methodology skill with no executable payload, hidden behavior, credential handling, or destructive instructions.
Install this if you want the agent to use a more deliberate diagnostic workflow. Before allowing it to inspect logs, configuration, databases, session stores, write .learnings/ notes, or hand work to another coding agent, make sure those actions fit the specific task and permissions you intend to grant.
This README says the skill "activates automatically when appropriate" without clearly defining boundaries, and it includes broad example invocations like "帮我分析一下这个问题" that overlap with common everyday requests. That combination can cause unintended invocation because users are not given a precise trigger scope or exclusion criteria for automatic activation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Anti-Patterns to Avoid
- **Guess-and-fix**: See symptom → change immediately
- **Surface fix**: Change bad value without asking why
- **Multi-change**: Change 3 things at once
- **Premature victory**: "Should be fixed" without verification
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Anti-Patterns to Avoid
- **Guess-and-fix**: See symptom → change immediately
- **Surface fix**: Change bad value without asking why
- **Multi-change**: Change 3 things at once
- **Premature victory**: "Should be fixed" without verification
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **Guess-and-fix**: See symptom → change immediately
- **Surface fix**: Change bad value without asking why
- **Multi-change**: Change 3 things at once
- **Premature victory**: "Should be fixed" without verification
## License
The manifest description presents the skill's activation guidance in Chinese with embedded English phrases, which effectively assumes the user can understand Chinese. The policy for this audit flags language or locale constraints when a skill forces a specific language without user opt-in, and no alternative language option or opt-in is provided here.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| One-end-only | Check only input or output | Trace full data flow |
| Surface fix | Change the bad value without asking why it's bad | Ask "why did it become this value?" |
| Multi-change | Change 3 things at once | One variable at a time |
| Premature victory | "Should be fixed now" without checking | Show evidence |
| No rollback | Forget to record original values | Backup before modify |
## Communication During Problem-Solving
The README uses a Chinese-language criterion ("你'd need to say '可能是...'" conceptually) and a Chinese trigger example in usage, but does not state that the skill is multilingual or that Chinese is optional. This can create an implicit language/locale constraint without user opt-in.
No suspicious patterns detected.