Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed multi-agent planning helper with a small local script that prints role boundaries and shows no hidden network, credential, persistence, or destructive behavior.
Before installing, expect a planning-oriented skill that may activate on broad multi-agent or task-decomposition language. Review the CLI mismatch if you intend to automate it; use the actual script flags shown by --help. No evidence was found of hidden network calls, credential handling, persistence, or destructive operations.
This markdown file presents the skill’s instructions and invocation guidance entirely in Chinese, including the one-line positioning and operational rules. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless a locale constraint is explicitly justified, which is not provided here.
The listed trigger phrases include generic concepts like collaboration, task decomposition, permissions, and orchestration, which are broad enough to match many benign requests. Overmatching is risky in this context because the skill is designed to decompose work across agents, so accidental activation could expose tasks to unnecessary multi-agent routing and complicate isolation assumptions.
The documented invocation conflicts with the declared interface and schema: the entry point is a CLI with args, but the example uses --mode orchestration while the parameter description says --mode should be parallel or serial, and the frontmatter schema defines inputs as task, agents, and json. This inconsistency can cause callers, wrappers, or automated platforms to invoke the skill incorrectly, which undermines guardrails and may lead to unsafe fallback behavior or bypass of intended constraints.
The trigger logic relies on broad keywords such as "multi-agent" or "task decomposition" without clear exclusion rules or context checks. In an agent platform, this can cause the skill to activate for ordinary planning requests, inserting orchestration behavior where it is not needed and potentially expanding the operational scope of the system.
The natural-language content of the skill index is entirely in Chinese and presents the skill description and invocation guidance in that language, with no indication that the user can choose another language. Under the language/locale policy, this is a potential violation unless the locale restriction is explicitly justified or made opt-in.
The trigger text is very broad and includes common phrases about AI collaboration, task decomposition, and orchestration. This can cause the skill to activate in ordinary conversations where the user is only discussing concepts, leading to unintended takeover of the interaction and possible disclosure or overreach into multi-agent planning when it was not requested.
The module docstring is written entirely in Chinese and the CLI/user-facing messages throughout the file are also Chinese, indicating the skill is designed to operate in a single language. The file does not offer any language selection or explain that the skill is intentionally region-specific, which matches the policy's language/locale violation criteria.
The primary CLI example hard-codes a Chinese task prompt ("写一份市场分析报告") in the English section, which can imply a default language expectation rather than offering a user choice. Because the file is otherwise bilingual and does not explicitly state that users may use any language, this creates a mild locale-policy concern.
