Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only development workflow checklist with command examples for local validation, with some overbroad wording users should treat cautiously.
Install this only if you want a Chinese-language development-process checklist. Review any shell command before allowing it to run, especially npm, Python, GitHub CLI, network checks, or deployment-related commands, and treat the generic CRUD/save/reset wording as insufficiently scoped rather than as permission for broad changes.
The manifest description and the entire instructional content are presented only in Chinese, while the skill is described as usable by arbitrary AI agents across platforms. There is no opt-in, language-selection guidance, or justification that the skill is intended only for a Chinese-language audience or region-specific context.
Granting the skill the generic exec tool is broader than necessary for a process-standard skill and the document repeatedly encourages running local shell, Python, Node, Git, and network-related commands. In an agent setting, unnecessary command-execution capability materially increases the blast radius from prompt confusion, unsafe interpolation, or repurposing of the skill for arbitrary local command execution.
The skill is presented as a development process/checklist, but the content expands it into a generic operational interface using input_params, config_options, and output_format with create/query/modify/delete semantics. That mismatch can cause an agent or user to over-trust the skill as harmless guidance while actually authorizing broader state-changing behavior than the description suggests.
The document claims support for save/import/reset/export/convert operations even though the skill is framed as a development standard and checklist. This widens the effective authority of the skill into persistent or state-mutating behavior, increasing the risk that an agent performs unintended changes under the guise of following process guidance.
The trigger conditions are so broad that they can activate on routine coding, debugging, testing, and deployment requests well beyond a narrow 'development standard' purpose. Overbroad activation increases the chance that the skill is selected in contexts where its exec-enabled guidance or state-changing claims are inappropriate, leading to unnecessary command execution or workflow interference.
