Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent code-review skill that reads code changes for review and does not install code, persist state, or perform hidden actions.
Before installing, expect the skill to inspect the code changes in your current repository when you ask for a review. For best results and tighter privacy control, provide a specific diff, PR, or file list instead of relying on automatic scope detection.
The file title, description, and usage instructions are entirely in Chinese, and line 15 instructs the skill to output a specific report format without indicating that users may choose another language. This can amount to a language-policy issue when the skill implicitly forces a locale without user opt-in or justification.
The skill advertises broad activation phrases like 'review my modified code', 'code review', 'best practices', and 'code score' without tight boundaries on when it should activate. This can cause the skill to trigger on generic requests and override more appropriate skills or workflows, increasing the chance of unintended data exposure or mis-scoped analysis in security-sensitive contexts.
The skill description uses broad trigger phrases such as “代码评审” and “代码评分” without clearly requiring concrete inputs like a diff, PR, or modified files. This can cause the skill to activate for general discussion requests and steer the assistant into an unintended review workflow, increasing prompt-selection errors and reducing response relevance.
The trigger section mixes specific conditions with ambiguous phrases like “审查修改” and “最佳实践方案,” but does not define minimum required inputs or exclusions. In a skill-routing context, this ambiguity can over-match ordinary advisory requests, causing the wrong skill to run and potentially leading the assistant to inspect local repo state unnecessarily.
The tagline and description force a specific language/locale in the skill’s natural-language metadata, which can violate language-choice policy when no opt-in or alternative is offered. Nothing in the file indicates that the skill is region-specific or that users can choose another language.
Language/locale policy applies to all file types. Even though the wording is permissive rather than absolute, the skill overall is Chinese-centric and does not state that output language should follow the user's preference, which risks an implicit locale bias without opt-in.
