Security audit
Security checks for vulnerabilities and agentic risk
This is a design-brainstorming workflow skill with disclosed, low-impact repository documentation writes, but users should watch for broad triggers and opt out when they only want casual discussion.
Install this if you want a structured Chinese-language brainstorming and design-approval workflow. Before using it, be aware it may activate on common design or idea terms and may create or update `.superpowers/design-approval.md` and `record.md`; explicitly opt out when you only want discussion without repository changes.
The trigger list contains broad everyday terms like '设计', '想法', and '创意', which can cause this skill to activate during ordinary conversation unrelated to repository planning. Because the skill then imposes workflow changes and may lead to file creation, accidental invocation can redirect agent behavior and produce unintended side effects.
The skill mandates creating .superpowers/design-approval.md as part of its normal flow, but it does not clearly warn the user that a repository file will be created. This can lead to unanticipated persistent changes, especially when the user only intended conceptual discussion rather than file modification.
The instruction to update record.md after task completion directs a file write without any user-facing warning or consent step. Silent persistence is risky because users may not expect documentation-only interactions to modify tracked files, which can introduce audit noise or unwanted changes into the repository.
The single-word trigger '设计' is extremely broad and likely to appear in benign conversations, making accidental activation probable. In the context of a skill that can alter workflow and instruct file creation, this increases the chance of unintended behavior.
The skill description and operating instructions are predominantly in Chinese, and the required approval examples are also framed in a fixed language context. Because there is no stated user language choice or justification for a Chinese-only workflow, this can violate language/locale policy expectations for skills intended for general use.
The trigger '想法' is generic and likely to match routine brainstorming or conversational text with no intent to run a workflow. This makes the skill easier to invoke unintentionally and can cascade into unnecessary gating or repository side effects.
The trigger '创意' is similarly overbroad and can appear in many innocuous user requests. Because the skill changes how the agent behaves and may lead to persistent file writes, broad matching increases the risk of unwanted workflow hijacking.
The skill expands from ideation guidance into instructing persistent repository updates such as record keeping. Even though the action seems administrative, automatic file writes create side effects outside the user’s immediate request and can silently alter project state or pollute commits.
No suspicious patterns detected.
