Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language code review checklist skill, and the flagged risky terms are examples of what to search for rather than instructions to perform unsafe actions.
Install this if you want a Chinese-language review checklist that makes agents scrutinize correctness, readability, architecture, security, performance, skills, and MCP servers. Expect it to encourage frequent reviews and read-only repository searches, but it does not contain executable code or hidden persistence behavior.
The natural-language description is presented entirely in Chinese and does not offer any language choice or indicate that the locale restriction is intentional and context-specific. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy violation.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
|----------|---------|---------|
| 提示注入(5种) | 指令覆盖、隐藏指令、有害内容 | 检查 markdown 注释/隐藏 HTML/零宽字符 |
| 数据外泄(4种) | 发送 env vars/文件到外部服务器 | grep `fetch`/`http`/`curl` + 检查目标URL |
| 特权升级(3种) | sudo/root/cron 持久化 | grep `sudo`/`chmod 777`/`cron`/`systemctl` |
| 供应链(6种) | 未锁定依赖、`curl\|bash`、混淆代码 | 检查 unpinned deps / Base64 / `eval()` |
| 过度代理(4种) | 不受限工具访问、自主高影响决策 | 审查工具白名单是否有 `*` 通配符 |
| 系统提示泄漏(3种) | 直接/间接提取系统指令 | 检查输出是否可能包含内部 prompt |
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
**Phase A: 静态扫描（原有）**
1. **危险函数扫描**：检查 scripts/ 目录是否有 `exec`/`eval`/`subprocess`/`__import__`
2. **网络行为**：grep 所有 `.js`/`.py`/`.sh` 中的外部URL，标记非已知域名
3. **依赖锁定**：检查是否有 unpinned deps（`*` 版本）或 `curl | bash`
4. **隐藏指令**：检查 markdown 中是否有 HTML 注释/零宽字符/Base64 编码块
5. **持久化检查**：grep `cron`/`systemctl`/`.bashrc`/`startup`/`schedule`
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
8. **偏差评级**：每个偏差标记 Benign/Suspicious/Malicious
**Phase C: MCP Server 安全审计（v1.4.0 新增，仅 MCP Server 部署时执行）**
9. **认证检查**：确认 OAuth 2.1/PKCE/Access Token 配置正确
10. **默认权限**：确认默认为 viewer（只读）模式
11. **凭证脱敏**：构造错误请求验证 error response 不含密码/token/路径
12. **破坏性确认**：确认 delete 类工具要求 `confirm` 参数
The activation line lists very broad situations such as "功能实现后、重构后、bug修复后" without defining specific invocation constraints, exclusions, or exact trigger phrases. In a markdown skill description, this ambiguity makes it unclear when the skill should activate versus when normal workflow discussion should not invoke it.
Phrases like "合并任何 PR 或变更之前" and "重要技术方案/文档提交之前" are expansive guidance rather than precise activation criteria. The section does not distinguish mandatory review workflow advice from the concrete conditions that should invoke this specific skill, increasing the risk of unintended or excessive invocation.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
|----------|---------|---------|
| 提示注入(5种) | 指令覆盖、隐藏指令、有害内容 | 检查 markdown 注释/隐藏 HTML/零宽字符 |
| 数据外泄(4种) | 发送 env vars/文件到外部服务器 | grep `fetch`/`http`/`curl` + 检查目标URL |
| 特权升级(3种) | sudo/root/cron 持久化 | grep `sudo`/`chmod 777`/`cron`/`systemctl` |
| 供应链(6种) | 未锁定依赖、`curl\|bash`、混淆代码 | 检查 unpinned deps / Base64 / `eval()` |
| 过度代理(4种) | 不受限工具访问、自主高影响决策 | 审查工具白名单是否有 `*` 通配符 |
| 系统提示泄漏(3种) | 直接/间接提取系统指令 | 检查输出是否可能包含内部 prompt |
No suspicious patterns detected.