Security audit
Security checks for vulnerabilities and agentic risk
This skill performs a disclosed local Java Maven project scan and writes analysis reports, with no evidence of hidden execution, exfiltration, persistence, or destructive behavior.
Install this if you want a Chinese-language first-pass Java Maven secondary-development report. Treat the invasive-change and upgrade-risk sections as heuristic triage, not a complete security or architecture audit, and run it only against project directories you intend the analyzer to read.
The skill promises analysis of ZIP archives and GitLab URLs, invasive-modification detection, and upgrade-pollution risk assessment, but the documented implementation support is much narrower. This can mislead users into trusting incomplete results, causing security or engineering decisions to be made on a false assumption of comprehensive analysis coverage.
Without declared permissions the skill's intent is opaque and cannot be validated.
The generated report strings are fixed in Chinese, which imposes a specific language on all users without any opt-in or documented justification. The policy explicitly calls out forced language or locale behavior as a natural-language policy violation when no choice is offered.
The report template is entirely written in Chinese, starting with the title on L01 and continuing through all section headings. This imposes a specific language/locale on users without any visible opt-in or justification that the skill is intended only for a Chinese-language context.
This code creates parent directories and writes both a JSON result file and a rendered report to disk, but there is no confirmation prompt, user-facing log describing the write actions, or inline comment/docstring warning about these file modifications. For a code-file audit under this rule, file writes should have at least some visible disclosure unless clearly documented elsewhere.
No suspicious patterns detected.
