Security audit
Security checks for vulnerabilities and agentic risk
The skill is not malicious, but it materially overstates its multi-agent orchestration and safety enforcement, so users should review it before relying on it.
Install only if you want a Chinese-language workflow template and are comfortable treating the safety checks as documentation, not enforced controls. Do not rely on it to actually spawn independent agents, block unsafe actions, or manage model quotas automatically without additional implementation.
The skill claims strong safety and control properties—multi-agent coordination, mandatory staged review, and automatic red-line enforcement—but the analyzed behavior does not implement those protections. This creates a dangerous trust gap: users or downstream agents may rely on nonexistent validation and policy checks, causing unsafe code generation or execution to proceed without the promised oversight.
The skill advertises executable/code-oriented behavior including file read/write workflows, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope boundaries can let the orchestrator be invoked with broader filesystem access than users expect, increasing the risk of unauthorized file access or modification.
The trigger phrases are broad and overlap with ordinary discussion of multi-agent systems, so the skill may activate in contexts where the user did not intend to invoke it. In a skill that influences orchestration, planning, and possible file/code actions, ambiguous activation can cause unintended behavior, policy confusion, or accidental use of elevated capabilities.
The manifest description and the entire operating examples are written as a Chinese-only interaction pattern, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the restriction is explicitly justified.
This JSON configuration uses Chinese-only natural-language values for agent names, roles, responsibilities, and red-line instructions throughout the file. Because there is no accompanying indication of user opt-in, locale selection, or region-specific justification in the file, it presents a language/locale policy concern under the natural-language policy rules.
Natural-language policy violations apply to all file types, including config files. The owner labels and checkpoint text use Chinese-only strings, which effectively impose a specific language/locale without any opt-in or explanation that the pipeline is region-specific.
This is a manifest file, so vague natural-language activation or usage conditions are in scope. The checkpoint descriptions are only provided in Chinese and do not clarify whether the skill is intended exclusively for Chinese-speaking users or systems, leaving the operational scope insufficiently specified.
The module docstring and manifest describe a ready-to-use multi-agent team orchestrator that automatically executes a six-stage pipeline, implying actual agent coordination. However, execute_phase() explicitly uses a mocked result (# 模拟执行（实际应该spawn子agent）) and never spawns, invokes, or communicates with any agents, so the documented behavior materially overstates what the code does.
The module docstrings and user-facing descriptions are entirely in Chinese, presenting the skill as a Chinese-language orchestrator with no indication that users may choose another language. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is clearly documented and justified.
The code advertises automatic red-line enforcement, but execute_phase never calls _check_red_line before simulating or recording an action. In a multi-agent orchestration skill, this creates a policy-enforcement gap: users or downstream components may rely on safety constraints that are not actually applied, allowing prohibited actions to proceed unnoticed.
This JSON log file contains user-facing natural-language strings such as "开始执行阶段" and "阶段完成" exclusively in Chinese across multiple entries. The file provides no indication that the skill is region-specific or that users can opt into this locale, which conflicts with the policy against forcing a specific language without user choice.
The module docstrings and user-facing console messages are written only in Chinese, with no indication that users may choose another language. This can violate a language/locale policy when a skill imposes one language by default rather than offering opt-in or documenting a justified regional scope.
The prompts and expected outputs are entirely written in Chinese, and the expected behavior appears to assume Chinese-language operation by default. Because this file provides test prompts/expected behavior with no indication of optional language selection or region-specific justification, it constitutes a natural-language locale policy concern.
The manifest description explicitly states '6阶段Pipeline强制执行', which conveys that all six stages are mandatory. However, the Phase 0 instructions later state that simple tasks may skip some stages, contradicting the earlier claim of mandatory execution.
The '核心理念' section says '6阶段Pipeline，不跳步', indicating stages cannot be skipped. Later, Phase 0 says simple tasks can skip some stages, which directly conflicts with that stated intent.
No suspicious patterns detected.
