Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed spec-driven development helper that edits project planning files and code only as part of its stated workflow.
Install this if you want a Chinese-language spec-driven development workflow that can create and modify repository planning files, code, tests, and status markers when invoked. Review generated specs and task updates before execution, and treat /spec-execute as a code-changing command that may run the repository's native test script.
The skill instructs the agent to append extracted tasks into specs/tasks.md automatically, but it does not require explicit user confirmation or warn that repository files will be modified. In an automation skill that edits planning artifacts, this can lead to unintended or unauthorized changes, especially if the input spec is incorrect, stale, or adversarially crafted.
The /spec-execute flow directs the agent to iteratively create tasks, modify code, write tests, run a script, and update tracking files automatically, yet it provides no safety checkpoint or warning about potentially broad repository impact. Because this is an execution-oriented engineering skill, the absence of confirmation, scoping, and review steps makes unintended code changes and unsafe command execution materially more dangerous.
The manifest description is written in Chinese, and the rest of the skill instructions are also presented only in Chinese, with no indication that users can choose another language. This can violate a language/locale policy when a skill implicitly forces a specific language without opt-in or justification.
No suspicious patterns detected.
