Security audit
Security checks for vulnerabilities and agentic risk
This skill performs disclosed local code-change impact analysis and does not show hidden, destructive, credential, network, or persistence behavior.
Install this if you are comfortable with a skill that inspects local git diffs and uses or triggers a local code graph index to analyze repository impact. Review the chained-skill behavior if you do not want automatic indexing or multi-agent review during commit, merge, or refactoring workflows.
The skill instructions, triggers, and examples are presented entirely in Chinese, which can effectively force a specific language on users without any opt-in or alternative. The file does not indicate that this locale restriction is intentional, optional, or tied to a region-specific requirement.
The activation rules are broad and include generic phrases plus implicit timing-based triggers like 'before commit/merge' and 'before refactoring', which can cause the skill to run outside explicit user intent. In an automated agent environment, unintended activation can lead to unnecessary repository inspection, command suggestions, and chaining into other skills, increasing the chance of overreach or unsafe tool use.
No suspicious patterns detected.
