Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown documentation-template skill with no executable code; its main cautions are around storing infrastructure details and following Chinese-language templates.
Install only if you want a Chinese-language project documentation convention. When using the templates, avoid writing passwords, tokens, private keys, or sensitive host details into shared Markdown, and review any AGENTS.md doc-map update so it stays limited to documentation navigation.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### 啟動
\`\`\`bash
docker build -t <image> .
docker run -d --name <container> --network <net> -p <port>:<port> --env-file .env <image>
\`\`\`
### 更新
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### 啟動
\`\`\`bash
docker build -t <image> .
docker run -d --name <container> --network <net> -p <port>:<port> --env-file .env <image>
\`\`\`
### 更新
The file includes imperative guidance in Chinese ("按需讀取") and elsewhere uses Chinese-only labels and descriptions, but does not state that the skill is intended for Chinese-speaking users or offer a language preference option. This can violate language/locale policy by implicitly forcing a specific language without user opt-in.
The examples for required documentation structure and update rules use Chinese-only descriptors such as "精簡總覽，每 session 必讀" and "改動類型 | 需要更新". Because the skill presents these as standard mandatory conventions for all projects, it effectively enforces a locale-specific language without documenting a justified regional scope.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
1. Identify which files are affected by the change (use the update rules table)
2. Update only those files — don't touch unrelated docs
3. Update version number in OVERVIEW if it's a release
4. Add entry to HISTORY with date, version, and bullet points
## Creating a New Doc Set
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
This markdown deployment template instructs users to stop and remove a container as part of an update flow, which can affect service availability and system state. The surrounding text provides no warning about downtime, rollback considerations, or the impact of running these commands.
The canonical meanings for the status symbols are defined exclusively in Chinese, which may force downstream documentation into that language. The file does not mention that this is a region- or team-specific standard, nor does it offer a language choice.
The document templates and embedded instructions are consistently written in Chinese, which may impose a language preference on users without opt-in or justification. There is no note that the skill is intended specifically for Chinese-speaking teams or that alternate language versions are available.
The deployment template asks users to record sensitive infrastructure access details such as server IP, username, path, and SSH command, and the database template includes connection metadata. The markdown does not warn users not to store secrets, private keys, or sensitive connection information in shared documentation.
No suspicious patterns detected.