Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language Windsurf usage guide that describes powerful IDE automation but does not ship code, install hooks, or hide unrelated behavior.
Installers should understand that the guide encourages use of Windsurf features that can modify code, run commands, and index projects. Use scoped context, review diffs and commits, keep secrets out of project context, and prefer Chat mode for sensitive repositories.
The skill description and guide are entirely written as a Chinese-language assistant resource, and the description labels it as an IDE assistant in Chinese without indicating that other languages are supported. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation unless the locale restriction is explicit and justified.
The skill explicitly promotes an agent mode that can autonomously read/write files and execute terminal commands, but it does not provide an upfront warning about the risks of codebase changes, dependency installation, or shell command side effects. In a developer-tool skill centered on autonomous execution, omission of clear safety boundaries and confirmation guidance increases the chance of unintended destructive changes or risky command execution.
This duplicate finding points to the same behavior: the agent can persist context and continue acting in Write mode, including self-directed repair attempts. That becomes security-relevant in an IDE assistant because autonomous persistence over project context can lead to unintended code modifications or execution of unsafe commands without sufficiently explicit stop/approval controls.
- **文件读写**：自动读取相关文件、创建新文件、修改现有代码
- **终端命令**：自动运行 npm install、git commit 等命令
- **上下文感知**：自动索引整个项目，理解文件间的依赖关系
- **Write/Chat 模式**：Write 模式直接修改代码，Chat 模式仅讨论不动代码
使用技巧：
- 描述目标而非步骤，让 Cascade 自己规划执行路径
This duplicate finding points to the same behavior: the agent can persist context and continue acting in Write mode, including self-directed repair attempts. That becomes security-relevant in an IDE assistant because autonomous persistence over project context can lead to unintended code modifications or execution of unsafe commands without sufficiently explicit stop/approval controls.
- **文件读写**:自动读取相关文件、创建新文件、修改现有代码
- **终端命令**:自动运行 npm install、git commit 等命令
- **上下文感知**:自动索引整个项目,理解文件间的依赖关系
- **Write/Chat 模式**:Write 模式直接修改代码,Chat 模式仅讨论不动代码
使用技巧:
- 描述目标而非步骤,让 Cascade 自己规划执行路径
No suspicious patterns detected.