Security audit
Security checks for vulnerabilities and agentic risk
This Markdown-only skill guides a coding agent through multi-agent software development, and its file edits, command use, tests, commits, and reviews are broadly aligned with that purpose.
Install only if you want a Chinese-documented workflow that can let an agent modify a repository, run commands/tests, create commits, and coordinate subagents. Use it on a branch or worktree, keep credentials scoped, review any callback URL before use, and avoid applying it to vague requests or sensitive repositories without clear task boundaries.
The visible display name, summaries, description, and most user-facing instructions are written in Chinese, while the file indicates compatibility with multiple agent platforms and does not state that the skill is China-specific or Chinese-only. Without an opt-in or explicit locale constraint, this creates a language/locale policy concern for users expecting language choice.
The main description frames the skill as a development framework for executing implementation plans, code generation, debugging, and deployment, and explicitly says it is not for vague needs. Later documentation advertises unrelated scenarios such as data synchronization, data extraction, ETL pipelines, and operations automation, which materially broadens the intent beyond the stated development-focused purpose.
The invocation scope is broad enough to match ordinary coding, debugging, or deployment requests, which can cause the skill to activate in contexts where the user did not intend multi-agent orchestration. Because the skill has read/write/exec capabilities, accidental activation can lead to unintended code changes, command execution, and repository modifications.
The skill exposes read, write, and exec capabilities but does not clearly warn users that it may modify files or run system commands. That omission undermines informed consent and can lead users to invoke the skill without understanding that local code, tests, branches, or environment state may change.
The '功能说明' section limits the skill to orchestration-style core capabilities, but the later '典型场景' section expands the intent to include API-driven cross-platform synchronization and direct system command automation. That is a substantive contradiction in stated purpose, not just missing detail.
Documenting an optional callback URL without warning about outbound data transmission creates a privacy and exfiltration risk. Users may supply internal endpoints or enable callbacks without understanding that task status, metadata, or potentially sensitive development context could be transmitted externally.
The usage flow explicitly includes implementation, testing, commits, and branch-completion steps, but it does not foreground that the repository will be changed. In practice this can surprise users and lead to unintended commits, branch mutations, or execution of project test commands with side effects.
The example trigger phrase is too generic and can be satisfied by casual discussion rather than an explicit request to invoke the skill. In a system that routes capabilities based on prompt matching, ambiguous triggers increase the risk of unintended execution of powerful file and command operations.
The capability section says the controller avoids letting child agents read the plan file, and the FAQ reinforces that approach. However, the workflow later instructs the system to read the plan file to extract all task text and context, which contradicts the earlier blanket wording if interpreted as a general prohibition on plan-file reading.
The API key section notes that keys should be protected, but it does not clearly state that the workflow may access environment-provided credentials during execution. This can lead to poor operator assumptions about credential exposure, especially when child agents or executed commands can inherit environment context.
No suspicious patterns detected.
