Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent OpenSpec bootstrap guide that installs/initializes OpenSpec and customizes project config, with no evidence of hidden or malicious behavior.
Before installing, confirm you are comfortable with a global npm install of OpenSpec and with the skill generating or overwriting OpenSpec-related project files. Run it in a clean git worktree so changes can be reviewed or reverted.
The invocation description and trigger examples are written only in Chinese, indicating a language-specific interaction model. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which it is not here.
The markdown presents zh-CN as the example language for generated artifacts, which can imply a preferred or default locale. Because no user opt-in or locale-selection guidance is included here, this risks violating the language/locale policy for skills that should not force a specific language.
No suspicious patterns detected.
