Security audit
Security checks for vulnerabilities and agentic risk
This automation skill needs review because it makes poorly documented service routing mandatory and persistent.
Before enabling heartbeats, replace the rayinai/pengui routing with providers you approve and establish what project content they may receive. Limit the agent to the intended project, set spending and stopping limits, and review MEMORY.md and HEARTBEAT.md, including automatic commits.
The template explicitly requires Chinese commit messages, and line 35 requires these rules to be copied into every agent's MEMORY.md. No language choice or justification for this output-language restriction is provided.
The mandatory tool-routing rules direct coding and documentation work through named interfaces without establishing their trust status or requiring authorization to share project content. In this autonomous, heartbeat-driven workflow, those rules could repeatedly send proprietary code, sensitive documents, or credentials to an unapproved provider; the excerpt does not establish that either interface is malicious or that disclosure has occurred.
No suspicious patterns detected.
