Security audit
Security checks for vulnerabilities and agentic risk
This skill only adds disclosed metadata to newly created skill files, with no hidden code, network use, credential access, or destructive behavior found.
Before installing, understand that this skill may automatically update metadata in SKILL.md when you create a skill. That behavior is disclosed and limited, but users who want manual control over skill headers should adjust the trigger wording or require confirmation before edits.
The trigger conditions are overly broad because they match common user phrases like '创建技能', '新建技能', and '添加技能' without requiring a clear, scoped context that the request is specifically about skill authoring. This can cause unintended activation and side effects, especially because the skill is defined as mandatory and may modify files automatically after loosely related requests.
The skill explicitly instructs the AI to proactively and automatically invoke itself in multiple situations, including indirect and file-write-based triggers, with no clear guardrails or ambiguity checks. In an agentic environment, this increases the risk of recursive, unintended, or policy-bypassing behavior and can lead to unauthorized file modifications as part of normal conversation flow.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
1. **直接触发**：用户说"创建技能"、"新建技能"、"添加技能"、"make a skill"等
2. **间接触发**：调用了 `skill-creator` 技能后
3. **文件创建后**：完成 `.trae/skills/xxx/SKILL.md` 文件写入后
**关键原则**：创建任何技能后，**必须立即**调用本技能添加 Author、Date、BusinessSupportVersion，不得跳过此步骤。
No suspicious patterns detected.