Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a local security-review helper, but its broad and mismatched trigger text could cause a read/exec-enabled skill to run in unrelated situations.
Install only if you specifically want a Chinese-language pre-install security review checklist for third-party skills. Keep its use limited to explicit skill-audit requests and review any command before execution, because the artifact asks for read/exec access and its trigger wording is broader than its actual purpose.
Overly broad trigger conditions can cause the agent to invoke this skill in unrelated contexts, increasing the chance that users or automation will apply its instructions where they do not belong. In an agent ecosystem, overmatching skills can hijack workflows, crowd out more appropriate tools, and lead to unnecessary file reading or exec-enabled review steps on irrelevant tasks.
The visible name, summary, description, instructions, examples, and outputs are entirely in Chinese, with no indication that users may choose another language. This creates a language-policy concern because the skill appears to impose a specific locale without opt-in or justification.
The manifest description uses vague, expansive wording about improving efficiency and supporting many development scenarios, which can make the skill match far more requests than intended. In a skill-selection pipeline, this increases the risk of inappropriate activation of a tool that advertises exec capability, expanding attack surface and creating opportunities for instruction confusion.
L047-L057 的“免费版与专业版对比”明确写明免费版仅提供“人工清单”，而不支持“自动扫描+AI分析”。但 L203-L339 的 SkillVetter 类会递归读取文件、按规则自动匹配红旗并自动计算风险等级，属于实际自动扫描能力。这与免费版能力描述直接不一致。
L174 表示该技能应在“数据分析、报表生成、统计洞察、数据可视化”时使用，但整份文档及代码主体都围绕第三方 Skill 安全审查、红旗检测和风险评估展开，L203-L339 的代码也仅执行安全扫描与报告生成。这说明清单级用途描述与真实行为存在明显偏差。
L403 明确写明“免费版无需API Key,所有审查在本地执行”，按此表述核心能力不应依赖网络。可 L415、L421 又把网络连通性与网络环境作为运行错误与执行效率限制的一部分，形成对运行方式的主动矛盾表述。虽然代码未体现网络访问，但文档内部 intent 存在冲突。
No suspicious patterns detected.
