Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation helper skill with some usability and scope caveats, but no evidence of hidden malicious behavior or unsafe execution.
Install only if you want an agent to help maintain technical documentation. Review any proposed changes to README, ADRs, changelogs, comments, CLAUDE.md/rules files, and git commits before accepting them, especially in repositories where agent rules affect future behavior.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
---
name: documentation-and-adrs
version: 1.0.0
description: "Document decisions and architecture rationale �� capture why, not just what"
The trigger list contains very broad, common terms such as 'README' and 'documentation', which can cause the skill to activate in many unrelated contexts. This increases the chance that the skill injects its instructions when the user did not intend to use it, leading to prompt-scope confusion and unintended behavioral override.
The skill is written almost entirely in Chinese and does not clearly provide a language-selection mechanism, so it may steer outputs into Chinese regardless of the user's language. This is primarily a safety and usability issue because it can override user expectations and reduce transparency, though it is less severe than direct instruction hijacking.
No suspicious patterns detected.