Security audit
Security checks for vulnerabilities and agentic risk
This skill is a normal project generator, but its generated deployment templates can create insecure database setups that users should review before running.
Review all generated code and deployment files before running them. Replace default database usernames and passwords, avoid using root/postgres for the app, remove or restrict database port publishing, and do not build or deploy projects generated from untrusted specifications in an environment with secrets.
assets/templates/docker-compose-mysql.txt:8Generated deployment configurations use predictable privileged database credentials and publicly exposed database ports
scripts/generate-backend.py:217Unvalidated specification values are interpolated into generated Java, TypeScript, Vue, URL, and Maven syntax
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- Java 17 -->
<properties>
<java.version>17</java.version>
<maven.compiler.source>17</maven.compiler.source>
Referenced artifact was not completely inspected
- `scripts/generate-frontend.py` - Generate Vue frontend with UI library selection
This markdown file contains multiple mandatory interaction instructions in Chinese, such as the required mode notice, while the overall document is otherwise in English. Because the skill does not offer users a language/locale choice or justify a Chinese-only constraint, it risks violating language/locale policy by effectively forcing one language for key workflow steps.
The requirement-description section defines acceptable inputs and examples primarily in Chinese, including mandatory user behavior, but the file does not state that the skill is region-specific or let users choose their preferred language. This can exclude or mislead users who expect the skill to operate in English based on the surrounding documentation.
The skill's required tech-stack selection flow is shown entirely in Chinese for the actual prompts users must follow. Since this is a central interaction path and there is no opt-in or locale justification, the file embeds a natural-language policy violation related to forced language use.
This JSON manifest contains user-facing descriptions, option names, notes, and selection instructions in Chinese only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
The module docstring states that it generates Java entity, repository, service, and controller artifacts. In this file, the implemented functions generate Maven configuration, application.yml, and an entity class, with no code paths generating repository, service, or controller classes. This is an active documentation-to-code mismatch, not just an omission in comments.
The generated JDBC URL includes serverTimezone=Asia/Shanghai, which imposes a specific locale-related setting in produced application configuration. This is a natural-language/policy-style locale constraint that is neither optional nor documented as region-specific, so it may violate language/locale neutrality expectations.
The datasource URL sets serverTimezone=Asia/Shanghai, which imposes a specific locale-related behavior in natural-language/config semantics for all consumers of the template. The policy allows locale constraints only when they are justified or user-selectable, and this file provides neither choice nor documentation.
This is a plain-text template file, so vague-trigger review applies. The template exposes generic placeholders like {{projectName}} and provides no surrounding natural-language description of when this template should be used or excluded, which makes invocation scope ambiguous if this file is used as a skill-facing artifact.
The natural-language/config value forces SPRING_PROFILES_ACTIVE=prod with no indication that the user can opt into another environment or that the production-only setting is required. This can violate language/locale-style policy constraints around forcing a specific operational mode without user choice or justification.
This markdown file presents all example user inputs in Chinese and does not indicate that other languages are supported or that the skill is intentionally limited to a Chinese-speaking context. That can imply a fixed language expectation without user opt-in, which matches the locale-policy concern for natural-language content.
This markdown file contains user-facing schema documentation where multiple field/type descriptions and feature labels are presented in Chinese alongside English identifiers. Because the document does not state that it is intended for a Chinese-speaking audience or offer an alternative language, it may violate a language/locale policy requiring user choice or explicit justification.
The docstring suggests a broader test harness for the generator using a sample tech stack. However, main() only constructs a sample tech_stack and prints the result of generate_pom_xml, without testing application.yml or entity generation. This contradicts the stated intent of the function as a representative test entry point.
In the Naive UI variant, the inline comments say Open create dialog and Open edit dialog, but both handleCreate and handleEdit are empty no-op functions. This is an active contradiction between the code comments and actual behavior, not merely missing detail.
No suspicious patterns detected.