Security audit
Security checks for vulnerabilities and agentic risk
This skill locally builds a causal knowledge graph from scoped memory/log files and does not show hidden execution, exfiltration, or persistence beyond writing its graph output.
Install only if you want a local graph derived from your workspace memory files. Review or redact MEMORY.md and memory logs first, and do not enable the documented LLM extraction idea unless you are comfortable sending that text to the chosen model provider.
The file presents the skill instructions and description primarily in Chinese, which can effectively force a specific language on users. There is no indication that users may opt into another language or that the Chinese-only presentation is required for a region-specific or compliance-related reason.
The skill explicitly ingests logs, memory files, and task files, which commonly contain sensitive operational data, personal information, credentials, or internal project context. Because the description provides no warning, scoping, redaction guidance, or data-handling limits, users may unknowingly expose sensitive content during graph construction.
The LLM-based extraction flow sends raw text into a prompt without warning that the content may be transmitted to an external model provider. If logs or memory files contain secrets, personal data, or confidential business information, this can cause unintended third-party disclosure and retention outside the user's trust boundary.
The package description is written entirely in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill implicitly enforces a language without opt-in or documented justification.
No suspicious patterns detected.
