Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple workspace-organization guide, with disclosed file cleanup behavior but no hidden code, network access, persistence, or credential handling.
Install only if you want the agent to enforce a project folder structure and clean up temporary or rejected generated files. If you need to keep drafts, rejected outputs, or temp files for audit or recovery, tell the agent explicitly before using the skill.
The skill instructs automatic removal of rejected outputs ('remove the file promptly') without requiring an explicit confirmation, recycle/trash behavior, or warning about irreversible data loss. In an agent context, a 'rejected' result may still contain useful work product or may be rejected accidentally, so this can lead to unintended destruction of user data.
The instruction to clean up temp/ after task completion authorizes automatic deletion without specifying user notice, retention period, or safeguards against misclassification of important files as temporary. In a workspace-management skill, broad cleanup behavior is more dangerous because the agent is explicitly entrusted with file lifecycle decisions across projects.
The file contains user-facing text in Chinese, including the cleanup prompt, despite the rest of the skill being written in English. This imposes a language choice without user opt-in and may violate language or locale policy expectations.
No suspicious patterns detected.
