Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only Krea 2 prompt helper with no executable behavior; the main caveats are broad activation wording and fixed English/Chinese output defaults.
Install it if you want a Chinese-oriented helper for writing Krea 2 megastructure prompts. Prefer project-level installation if you only want it available in one workspace, and expect generated prompts to default to English with Chinese notes unless you ask otherwise.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
最终路径形如：
~/.workbuddy/skills/krea2-megastructure-prompts/SKILL.md
复制完成后重启一次会话（或新开一个对话），即可通过描述需求触发。
The README says the skill can be triggered simply by 'describing your needs,' which is an ambiguous activation condition for a markdown skill description. This broad phrasing does not define what kinds of requests should or should not invoke the skill, increasing the risk of unintended activation during ordinary conversation.
The sample triggers are presented as plain natural requests such as '帮我写一个...' and '给我 3 个...', which are common conversational phrases rather than clearly scoped skill invocations. Because there are no negative examples or activation constraints, these examples may encourage accidental triggering outside the intended Krea 2 prompt-generation context.
The README states that output includes '1 条英文主提示词' because 'Krea 2 is an English model,' which imposes a language choice in the skill's behavior. This is a natural-language policy concern because the documentation does not indicate that users may choose another language format or opt in to English-only output.
The trigger description is excessively broad, matching generic requests about anything "huge," "epic," or "impressive," which can cause the skill to activate outside its intended niche. Overbroad activation can hijack unrelated conversations, override more suitable skills, and produce unwanted prompt-generation behavior that degrades routing integrity and user intent handling.
The skill metadata says output includes English prompts plus Chinese explanation and parameter advice, without indicating adaptation to the user's language. This can override user language preference, leak unexpected language into downstream workflows, and reduce usability or correctness in multilingual contexts where output format matters.
Line L003 states that every prompt is a complete English long sentence for direct use, which imposes a specific language choice. The file does not offer an alternative language option or indicate that English is optional, so it conflicts with the language/locale choice policy.
This markdown skill forces a specific language for its instructions and guidance, and nowhere indicates that the user can opt into Chinese or select another language. Under the stated policy, a language constraint is a natural-language policy issue unless it is optional or clearly justified as region-specific.
The document is written as a Chinese-only skill reference, including headings and instructions, with no indication that users may choose another language or locale. Under the policy rules, forcing a specific language without opt-in is a natural-language policy violation unless clearly justified as region-specific.
This markdown file contains user-facing guidance exclusively in Chinese, including headings, usage notes, and instructions. Under the language/locale policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no justification or language choice is provided.