Security audit
Security checks for vulnerabilities and agentic risk
This is a mostly transparent task-planning skill, but it gives a very broad planner permission to use files, web search, code execution, and other skills without enough scoping or user consent rules.
Review this skill before installing if you do not want a broad planning framework to influence ordinary task requests. Only use it with agents that ask before web searches, file writes, code execution, bookings, account actions, or loading additional skills, and avoid giving it confidential project details unless external search/tool use is explicitly disabled or approved.
The trigger list includes very generic terms like '执行', '任务分解', '工作流', and '流水线', which are likely to appear in ordinary conversation. That creates a prompt-activation weakness where the skill may be invoked unintentionally, causing its broad planning and tool-selection behavior to apply outside the user's intent.
The trigger phrases are very generic task-management terms such as '执行', '内容', '创新', '任务系统', and '全栈任务', which are likely to appear in many normal user requests. This can cause unintended activation of the skill in unrelated contexts, leading to prompt hijacking of ordinary conversations, user confusion, or inappropriate application of the skill's workflow where it was not requested.
Natural-language instructions and the description are presented in Chinese, which may impose a language expectation on users without opt-in. Under the policy, language constraints should either be user-selectable or explicitly justified as region- or audience-specific.
The manifest describes a '通用三轴任务操作系统' with an execution axis plus optional content and innovation axes. This file is solely a 'Capability Pipeline OS' focused on execution decomposition, pipeline orchestration, and capability units, with no implementation of the manifest's content-axis methods ('清单法+样本法') or innovation-axis methods ('4种模式+10种元框架').
The file authorizes a generic task framework to select among web access, file I/O, code execution, and loading other skills 'as needed' without restricting scope, trust boundaries, or approval requirements. In a universal planner, this can transform ordinary user requests into broad operational authority, increasing the risk of unsafe execution, data exfiltration, filesystem modification, or privilege expansion through chained tool/skill use.
The markdown normalizes potentially dangerous operations such as file writes, web access, and code execution as ordinary implementation choices, but does not pair them with user-visible warnings, consent gates, or safety constraints. In a reusable orchestration skill, that omission can lead operators or downstream agents to perform sensitive actions without recognizing the need for authorization and containment.
The skill explicitly allows network search to obtain component lists or samples, but it does not require a user-facing notice that the query content, task details, or sample-derived terms may be sent to external services. This creates a real privacy risk because users may unknowingly disclose sensitive project, personal, or proprietary information when the agent follows the workflow.
The dedicated network search strategy operationalizes external searching but omits any privacy, confidentiality, or data exposure warning. Because this section reads like prescriptive guidance, it increases the chance that an agent will automatically formulate and transmit user task details to third-party search providers without informed consent.
The title and all operational instructions are written in Chinese, and the file presents itself as a general-purpose innovation skill for "任意领域" rather than a region-specific or Chinese-only tool. Because the skill does not state that language is optional or user-selectable, it implicitly imposes a specific language/locale on all users.
The skill is written entirely in Chinese and presents Chinese trigger words and operating instructions without any indication that language should follow the user's preference. This can override or bias agent behavior toward Chinese output, reducing user control and potentially causing unsafe misunderstandings in multilingual contexts, but it is not a direct code-execution or data-exfiltration issue.
The document repeatedly states that any task in any domain can be decomposed and completed through six meta-operations, yet the concrete execution model later relies on optional tool calls, skill loading, human collaboration, and ad hoc domain calibration. That makes the 'cover all task types' claim broader than what this artifact itself actually operationalizes.
All user-facing instructions and examples are in Chinese, and the document does not indicate that language selection is optional or region-specific. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy issue unless the constraint is justified.
No suspicious patterns detected.
