Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed coding-workflow router with no embedded executable code, persistence, credential access, or hidden data handling.
Installers should understand this is a Chinese-language coding-workflow router. It may direct the agent toward downstream skills that edit repository files, run tests or dependency commands, or prepare git work, so review those routed actions before approving changes in important repositories.
The skill declares Chinese trigger phrases that are broad, conversational wording like '该用哪个技能' and '先分析还是先写代码'. Because these phrases can appear in ordinary discussion, the skill may be invoked unintentionally in contexts where the user is merely asking for advice rather than requesting orchestration, causing misrouting and unnecessary capability chaining.
The user-facing display name, description, and default prompt are all written in Chinese, which indicates a fixed language choice with no visible user opt-in or language-selection mechanism in this file. The policy requires flagging language or locale constraints when the skill forces a specific language without offering a choice or documenting a justified regional scope.
该文档是 markdown 文件，适用 SQP-1。示例触发语“这个报错怎么修”过于常见且缺少作用域约束，类似的自然对话在很多上下文中都会出现，可能导致在任务边界不清时误路由到 $code-debug。
“执行命令、跑测试、安装依赖”覆盖面很广，且未说明仅限安全、受控的开发环境或特定命令范围，容易与普通对话中的类似请求重叠并导致不必要的 $shell-safe-exec 调用。文档也未提供负例或约束条件来收窄触发范围。
该文件中的自然语言说明与示例均固定为中文，未见提供用户语言/地区选择或说明这是仅面向中文用户的受限场景。按规则，强制单一语言而无用户 opt-in 可能构成语言/locale 策略问题。
No suspicious patterns detected.
