Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local performance-analysis and optimization helper with some overbroad wording, but I found no hidden persistence, credential access, network behavior, or code-rewriting implementation.
Before installing, note that the docs and metadata overstate the capability and the profiler repeatedly executes whatever function you pass to it. Use it only on tasks where repeated execution is acceptable, and do not treat the package description's code-rewriting claim as an implemented or reviewed safety feature.
The skill documentation is written entirely in Chinese, including its description and usage sections, with no indication that language selection is optional or that the skill is region-specific. This creates a natural-language policy concern because it effectively imposes a specific language on users without opt-in.
The package description advertises sweeping capabilities such as performance analysis, strategy optimization, auto-tuning, and especially code self-rewriting without stating any trigger conditions, boundaries, or safety constraints. In an agent skill, this ambiguity is risky because it normalizes autonomous self-modification behavior that could be invoked too broadly or interpreted as permission to alter code or behavior without adequate approval or sandboxing.
No suspicious patterns detected.
