Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Cursor workflow guide for structured software development and does not show hidden access, persistence, exfiltration, or destructive behavior.
Install this if you want a Chinese-language, structured coding workflow in Cursor. Be aware that generic mentions of 'vibe' or phase numbers may trigger it, so users who prefer explicit opt-in triggers or another language may want the publisher to narrow the activation wording and document language choice.
All user-facing instructions and examples are presented only in Chinese, and the document does not state that other languages are supported or that Chinese is an optional preference. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
## Skill：vibe-coding-workflow
- **名称**：`vibe-coding-workflow`
- **位置**：`.cursor/skills/vibe-coding-workflow/SKILL.md`
- **作用**：规范 AI 在整个开发过程中的协作方式，强制按照以下 5 个阶段来推进：
- **Phase 1 需求描述**：从一句模糊想法，走到结构化、可执行的需求文档（澄清 → 技术选型 → 模板固化）；
- **Phase 2 架构设计**：在写第一行代码前，先确定项目目录结构、模块职责、数据流向和接口约定；
The auto-trigger examples are broad enough that ordinary conversation terms like 'vibe', '氛围编程', or generic phase references could invoke the skill unintentionally. In an agent environment, unintended invocation can alter assistant behavior and push users into a workflow they did not explicitly request, which is a real prompt-routing and control-scope risk even though the content itself is not overtly malicious.
Most of the instructional content is presented in Chinese, and the skill directs the assistant to follow these instructions without indicating that the user can choose another language. This creates a language-policy concern because it may effectively force a specific language or locale absent explicit user opt-in.
The activation criteria are broad and keyword-driven, causing the skill to auto-trigger on generic terms like 'vibe', '规范工作流', or phase numbers without confirming user intent. This can unexpectedly steer unrelated conversations into a prescriptive workflow, increasing the chance of inappropriate guidance, context capture, or undesired file/code modifications in a development environment.
No suspicious patterns detected.