Security audit
Security checks for vulnerabilities and agentic risk
This is a plain Markdown debugging guide with broad activation wording but no hidden code, persistence, credential handling, or unsafe installation behavior.
Installers should understand this skill is intended for Chinese-language debugging help and may activate on general debugging phrases. Review any generated tests or fixes before applying them, and avoid pasting secrets such as API keys or tokens into debugging logs.
The trigger phrases are broad, generic debugging terms like 'debug', '帮我看看', and '为什么不行', which are likely to appear in ordinary conversation and can cause unintentional activation. This increases the chance the skill intercepts requests outside a clear user opt-in boundary, creating routing and prompt-scope confusion rather than direct code-execution risk.
The manifest description embeds multiple vague trigger words in a free-form description without defining strict activation conditions. If platform logic or downstream tooling uses manifest text for discovery or invocation hints, this can further blur when the skill should activate and contribute to unintended engagement.
The skill metadata and introductory text are written as a Chinese-only persona (“AI调试大师”) with no indication that users may choose another language. This creates a language/locale constraint that is not documented as optional or justified for a region-specific use case.
