Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Chinese-language code-review helper with no bundled executable code, hidden behavior, persistence, or credential access.
Install only if Chinese-language documentation is acceptable. Also note that the package references node scripts/review.mjs, but that script is not included in the inspected artifact, so the skill may be incomplete or nonfunctional unless the installer supplies it elsewhere.
The entire skill description is written in Chinese, including the title and usage guidance, with no indication that other languages are supported for user-facing documentation. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale limitation is explicitly justified.
The manifest description and user-facing heading/body are entirely in Chinese, which signals a fixed language experience. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context.
No suspicious patterns detected.
