Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed prompt-compilation helper with optional local scripts and repo-rule extraction, with no evidence of hidden exfiltration, destructive behavior, or persistence.
Before installing, be aware that this package adds local executable Python helpers and can optionally read common repository files to infer coding rules. Review generated handoff prompts before pasting them into another coding agent, especially when using repo-aware mode.
If the skill also serves as a regression or integration harness while claiming to only transform user requests, it may trigger script execution and file access unexpectedly. That makes the context more dangerous because the skill is designed for automatic use on vague requests, lowering the threshold for unintended activation.
If the skill also serves as a regression or integration harness while claiming to only transform user requests, it may trigger script execution and file access unexpectedly. That makes the context more dangerous because the skill is designed for automatic use on vague requests, lowering the threshold for unintended activation.
If the skill also serves as a regression or integration harness while claiming to only transform user requests, it may trigger script execution and file access unexpectedly. That makes the context more dangerous because the skill is designed for automatic use on vague requests, lowering the threshold for unintended activation.
If the skill also serves as a regression or integration harness while claiming to only transform user requests, it may trigger script execution and file access unexpectedly. That makes the context more dangerous because the skill is designed for automatic use on vague requests, lowering the threshold for unintended activation.
If the skill also serves as a regression or integration harness while claiming to only transform user requests, it may trigger script execution and file access unexpectedly. That makes the context more dangerous because the skill is designed for automatic use on vague requests, lowering the threshold for unintended activation.
If the skill also serves as a regression or integration harness while claiming to only transform user requests, it may trigger script execution and file access unexpectedly. That makes the context more dangerous because the skill is designed for automatic use on vague requests, lowering the threshold for unintended activation.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
else:
scan_text(candidate.read_text(encoding="utf-8"), rules)
return rules
This markdown file states that a Chinese-first language preset and Chinese templates were added, which indicates a language preference being enforced or prioritized. Under the policy rule, forcing or defaulting to a specific language without explicit user opt-in is a natural-language policy concern, and the changelog text does not mention any opt-in, choice, or regional justification.
The skill advertises and encourages execution of local scripts and repository inspection, but it does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization gap where an agent may invoke shell, file-read, or potentially network-capable actions without the skill clearly constraining them, increasing the chance of over-privileged execution.
The instruction to 'use this skill automatically when a user gives a vague coding request' is overly broad and can trigger repository-aware analysis or script-oriented workflows without clear user consent. Automatic activation is especially risky here because the skill includes optional shell and repo-analysis pathways that exceed simple prompt rewriting.
The phrase 'Chinese-first output' indicates a default language or locale preference. The file does not clearly state that this language behavior is optional or only used when the user explicitly requests it, which can violate language/locale choice policy.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Core Rule
When this skill is triggered by a rough coding request, do not ask the user to run scripts first.
Instead:
The general template is a catch-all prompt that can be invoked for vague or everyday requests, which increases the chance the skill is applied outside its intended coding-brief compilation context. In an agent system, overly broad triggers can cause inappropriate auto-selection, letting untrusted user input steer downstream coding or planning behavior without sufficient scoping.
The file defines a chinese-first language preset alongside english-first, and later logic uses that preset to generate fully localized Chinese prompts. This creates a built-in path for forcing a specific language/locale choice without any documented user opt-in, which matches the language-policy violation criteria.
These lines choose Chinese templates or apply Chinese localization whenever language_preset is chinese-first, but the file contains no safeguard ensuring that this locale was explicitly requested by the end user. Because the policy forbids forcing a specific language without user opt-in, this natural-language behavior is noncompliant.
The file defines a chinese-first language preset alongside english-first, and later uses that preset to generate the handoff entirely in Chinese. This is a natural-language locale constraint that can be imposed by the caller, but the file contains no user-choice safeguard or justification for why a non-default language should be forced.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd += ["--repo-root", repo_root]
if auto_repo_rules:
cmd += ["--auto-repo-rules"]
result = subprocess.run(cmd, capture_output=True, text=True, check=True)
return json.loads(result.stdout)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd += ["--repo-root", repo_root]
if auto_repo_rules:
cmd += ["--auto-repo-rules"]
result = subprocess.run(cmd, capture_output=True, text=True, check=True)
return json.loads(result.stdout)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_case(repo_root: str) -> dict:
result = subprocess.run(
[sys.executable, str(SCRIPT), "--repo-root", repo_root],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_script(script_name: str, args: list[str]) -> dict:
script_path = ROOT / script_name
result = subprocess.run(
[sys.executable, str(script_path), *args],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_script(script_name: str, args: list[str]) -> dict:
script_path = ROOT / script_name
result = subprocess.run(
[sys.executable, str(script_path), *args],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_script(script_name: str, args: list[str]) -> dict:
script_path = ROOT / script_name
result = subprocess.run(
[sys.executable, str(script_path), *args],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_case(args: list[str]) -> dict:
result = subprocess.run(
[sys.executable, str(SCRIPT), *args],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_case(args: list[str]) -> dict:
result = subprocess.run(
[sys.executable, str(SCRIPT), *args],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def compile_request(request: str) -> dict:
result = subprocess.run(
[sys.executable, str(SCRIPT), "--request", request, "--output", "json"],
capture_output=True,
text=True,