Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only development workflow skill with expected code-editing and command authority, but its generic API/credential boilerplate should be read carefully before use.
Install only if you want a multi-agent development workflow that can read files, run commands, edit code, and coordinate review agents. Use it on an isolated branch or worktree, give it a concrete implementation plan, and do not provide API keys just because the generic setup section mentions them unless your own agent environment explicitly requires them.
The activation language is extremely broad, covering generic coding, debugging, testing, and deployment scenarios. In an agent environment with exec/write tools, vague applicability can cause over-triggering of a powerful workflow in contexts where simpler or safer handling is appropriate, increasing operational and security risk.
The entire user-facing skill documentation and examples are written in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language environment. This can violate language/locale policy when a skill implicitly forces a specific language without user opt-in.
The document states that no extra API key is required because the skill is Markdown-based, but later instructs users to configure API keys and establish API connections. This inconsistency can mislead operators about credential requirements, causing unsafe setup behavior, accidental secret exposure, or inappropriate trust in undocumented external integrations.
The skill is primarily described as a Markdown orchestration workflow, but later claims broad CRUD, API, and file-processing capabilities that are not grounded in the actual workflow. This overclaiming expands perceived authority and may cause an agent or user to apply the skill in inappropriate contexts, increasing the chance of unsafe command execution, unintended file operations, or misuse of external services.
The invocation guidance describes when to use the skill but does not provide precise trigger phrases or strong exclusion-focused constraints. This ambiguity makes accidental activation more likely, which is risky because the skill is designed to orchestrate multiple agents and potentially drive file and command operations.
