Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-language agent-design helper that creates OpenClaw configuration and skill-package skeletons with no executable payload or hidden system changes found.
Install this if you want a Chinese-language workflow for designing OpenClaw agents and generating configuration/skill skeletons. Review any generated skill package, API/database configuration, and publishing step before approving it, especially when connecting real business systems.
The identity document presents the skill entirely in Chinese and does not provide a user-language choice, fallback, or opt-in mechanism. This can cause users to misunderstand capabilities, constraints, or safety-relevant guidance, especially in a meta-agent that designs other agents and may collect requirements or produce configurations based on misunderstood input.
The trigger conditions are broad enough to match very common user requests such as designing an agent or building an assistant, which can cause this skill to activate in situations where a different, more appropriate skill or safer workflow should handle the request. Because this skill is an agent incubator that can generate configurations, skills, and integration plans, over-triggering increases the risk of unintended scope capture, confused-deputy behavior, and unsafe automation design without sufficiently explicit user intent.
The trigger table uses ambiguous mappings like '帮我连接数据库/API' and '发布 Agent' without precise boundaries or safety gates, so the skill may claim requests that involve sensitive integrations, deployment steps, or architectural changes beyond a simple design consultation. In this context, the skill explicitly plans data sources, tool bindings, and skill packaging, making ambiguous activation more dangerous because it can steer users into configuration and integration actions that should require stricter validation and approval.
The entire skill guidance is written as a Chinese-only behavioral standard and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
No suspicious patterns detected.
