Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple workflow logging template that creates project documentation, with no hidden execution or privilege behavior found.
Install only if you want project workflow logs written into your repository. Review generated logs before committing, especially for secrets, file paths, customer information, incident details, or sensitive debugging context.
The description says to invoke the skill when the user asks '记录流程、任务复盘、过程记录、日志记录、决策记录', several of which are generic phrases that could overlap with ordinary requests rather than a narrowly defined skill activation. The file does not provide exclusion conditions, negative examples, or tighter context limits to clarify when the skill should and should not trigger.
The skill name, description, and operational instructions are entirely in Chinese, and there is no indication that the user can choose another language. Per the policy, language constraints should not be imposed without explicit user opt-in or a documented justification.
The skill directs saving process logs into docs/process/ without warning that logs may capture sensitive internal context such as incident details, file paths, debugging output, or decision rationale. In a repo-based workflow, this can lead to accidental persistence and later publication of sensitive information through commits, documentation hosting, or team sharing.
No suspicious patterns detected.
