Security audit
Security checks for vulnerabilities and agentic risk
This is a project-specific development workflow skill with disclosed device deployment risks and backup requirements, not hidden or malicious behavior.
Install this only for the intended Xianmu Box repository. Before using deployment or firmware steps, confirm the target serial port, back up the device settings.json, and verify restoration after deployment because device WiFi, alarm, or cloud activation settings can be replaced by the repository skeleton.
The skill is configured to auto-apply to nearly any development-related request in the repository, including cases where the user did not explicitly invoke the workflow. Overly broad triggering can override user intent, force unnecessary operational steps, and increase the chance that sensitive or destructive actions such as deployment guidance are introduced into unrelated conversations.
文档要求提交“只走命令行”，并以“本仓库 31 个中文名文件”为理由约束操作方式，整体内容也默认采用中文命名与中文工作流，但未说明是否允许用户选择其他语言/locale方式。若该技能面向一般用户或通用开发场景，这种隐含的语言/locale 强约束可能构成语言策略上的不当限制。
The file states that each file must begin with a Chinese docstring, which is a natural-language policy constraint forcing a specific language. The rule does not present this as optional, nor does it offer an opt-in or alternative locale, so it may violate language-choice policy expectations.
The document explicitly warns that deployment can overwrite the device's settings.json with a sanitized repository skeleton, which can silently erase or replace live configuration during routine workflows. In a device-debug/deployment skill, this is a real operational security and reliability risk because it can reset network endpoints, credentials, feature flags, or safety-relevant runtime settings without an explicit confirmation step.
No suspicious patterns detected.
