Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent Dapr/.NET backend template skill, but its generated production code patterns include broad database escape hatches and permissive API defaults that deserve review before use.
Review generated projects before running or deploying them. In particular, restrict CORS origins, avoid exposing raw SQL helpers outside tightly controlled repository code, require parameterized queries, make zh-CN culture configurable, and approve any DEBUG helper that starts daprd locally.
The skill hard-codes Chinese locale, Unicode JSON encoding, and a fixed datetime format as a non-negotiable rule rather than making them conditional on user or project requirements. This can override caller expectations, reduce output neutrality, and cause integration or localization issues in downstream systems that expect different locales or serialization behavior.
The document presents the Program.cs snippet as a complete startup template, but the code builds the application before registering services and middleware extensions. Consumers who copy this pattern may end up with missing service registrations, broken health checks, logging, Dapr integration, or inconsistent startup behavior, creating reliability and security-hardening gaps in deployed services.
The manifest describes a backend architecture/code-generation skill focused on Dapr + .NET project setup, layering, and service/controller code. This template specifically includes AddCustomDaprdProcess and, in DEBUG, calls BaseHelper.AddDaprdProcess(...) to start an external sidecar process, which is a host/process-management capability rather than ordinary API wiring.
The Program.cs example forces CultureInfo.DefaultThreadCurrentCulture to zh-CN, which is a natural-language/locale constraint. The document does not present this as optional, ask for user opt-in, or explain a region-specific requirement, so it conflicts with the policy against forcing a specific locale without choice.
This markdown file presents all instructions and examples exclusively in Chinese, which can impose a language constraint on users without opt-in. The policy allows locale constraints only when they are explicitly justified or when users are given a choice, neither of which is present here.
This markdown file presents the skill content entirely in Chinese, including the title and descriptive guidance, without indicating that language selection is configurable or that the skill is region-specific. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
The Application/BaseService template exposes a very broad set of raw SQL execution primitives (ExecuteCommand, SqlQuery, GetScalar, DataReader, DataSet, etc.) directly through the service layer. In a code-generation or copy-paste template context, this normalizes unsafe query construction and makes downstream SQL injection far more likely if callers concatenate user input into the sql string, while also bypassing domain and repository constraints the architecture is supposed to enforce.
This markdown file contains user-facing instructional content only in Chinese, beginning with the title and introductory note. Because there is no opt-in, alternative language option, or justification that the material is intended only for a Chinese-language audience, it may conflict with language/locale policy requirements.
The ApiResult helper reflects over returned objects and emits ModelType metadata listing property names and types. This can leak internal schema and implementation details to clients, aiding reconnaissance and exposing fields that were not intended to be documented or inferable from the API surface.
The method is named and documented as GetDataReaderAsync, and the body awaits an async repository call, but the signature returns IDataReader instead of Task<IDataReader>. This directly contradicts the intent communicated by the method name and documentation, creating misleading behavior for consumers of the template.
