Security audit
Security checks for vulnerabilities and agentic risk
The skill is not clearly malicious, but it asks for broad CloudBase deployment and database authority with weak scoping and persistent local learning behavior.
Install only if you intend to let an agent assist with real CloudBase development and deployment work. Before using it, require explicit confirmation for production deployments, database writes, provider/auth changes, and any action that may incur cost or affect live users. Avoid putting secrets, tokens, credentials, or sensitive incident details into learner notes or preferences because they are stored locally in plaintext.
声明描述的是一个面向 cloudbase 生态的复杂元技能/编排器，重点在全栈开发部署能力、教师技能蒸馏、路由决策、自验证与对抗验证。实际代码仅是一个独立的学习记录模块，提供 init/record/prefer/insight/reflect 五类命令，操作本地 JSON 文件保存统计数据和偏好，并根据阈值给出复盘建议。虽然代码中存在“自我反思/持续改进”这一很弱的概念重叠，但这只是通用日志分析与建议生成，不足以支撑声明中的主要用途。因此属于明显的描述与行为不符。
The skill advertises deployment, database, and environment-management behavior but does not declare any explicit tool scope such as allowed-tools or permissions. In an agentic environment, missing scope boundaries can let the runtime grant broader file-writing or operational capabilities than users expect, increasing the chance of unintended modification of local files or adjacent assets.
The invocation guidance says to directly call the skill for broad CloudBase development, deployment, and launch tasks without clear trigger constraints or safety gates. In practice, such open-ended activation criteria can cause an agent to apply the skill to sensitive production operations too eagerly, especially when combined with the skill’s broad stated authority.
The skill promotes deployment and go-live usage but lacks an explicit warning that actions may affect live environments, production data, or cloud resources. Without a prominent warning, users may invoke it assuming it is advisory only, increasing the risk of accidental deployment, data modification, cost incurrence, or service disruption if paired with real tools.
This code file contains natural-language documentation and CLI-facing text entirely in Chinese, presenting the module as a generic component for any WorkBuddy skill. Because it is framed as universally reusable rather than region-specific, this imposes a specific language/locale without user choice, which matches the policy-violation criteria.
The module persists notes, preferences, and operation history to learned_patterns.json without any consent prompt, sensitivity filtering, or file-permission hardening. In a skill ecosystem, users may place secrets, tokens, personal data, or incident details into --note/--val fields, and those values would be stored locally in plaintext where other local users, backups, or support tooling could access them.
The entire report is presented in Chinese, and the file does not indicate any user choice or opt-in for language/locale. Under the policy rule, a skill that enforces a specific language without user opt-in can be a natural-language policy violation.
This JSON file contains natural-language labels such as "蒸馏增强" in capability metadata and recent operation records, but provides no indication that language selection is configurable or intentionally limited to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in can be a locale-policy violation.
No suspicious patterns detected.
