Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed multi-agent orchestrator, but its broad activation phrases could cause extra subagents to run and receive context more easily than users may expect.
Install only if you want an agent to create and coordinate subagents. Use clear, explicit requests when invoking it, and watch for unnecessary fan-out because child agents may receive task context and inherit the main agent's permission mode.
The trigger phrases for fan-out and pipeline modes are broad, natural-language patterns such as '然后' and '依次' that commonly appear in ordinary user requests. This can cause the orchestrator to invoke multi-agent spawning unintentionally, increasing privilege/automation scope, token consumption, and the chance that sensitive context is propagated to unnecessary subagents.
Coordinator-mode triggers like '分配任务', '组建团队', and '分工协作' are ambiguous and can match high-level planning language rather than an actual request to spawn agents. In a skill whose purpose is to create and coordinate multiple subagents, such ambiguity is more dangerous because it may silently escalate a normal interaction into broad parallel execution and wider context dissemination.
No suspicious patterns detected.
