Security audit
Security checks for vulnerabilities and agentic risk
This local quality checker needs review because failed checks still return success, and its file access does not enforce the promised boundary.
Use this as an advisory checklist until failed checks reliably return a failing exit status and file access rejects links outside the selected directory. Review the printed results before publishing and use a dedicated secret scanner. Its bilingual rules are disclosed presets. All bundled files were reviewed; the scanner's missing specification reference does not conceal an executable dependency.
The bilingual checks require English and Chinese in the description and README, and the gate blocks release when any check fails. This imposes specific natural languages on user-authored artifacts without offering a language choice or documenting a marketplace or regional requirement that justifies the constraint.
The README and description checks require both Chinese characters and English words, and the remediation explicitly says “需中英简介” (Chinese and English introductions required). This enforces specific documentation languages without offering a language choice or explaining a locale-specific need.
The script prints failed checks but returns normally, producing exit status 0 even when it detects plaintext secrets or other release-blocking failures. Automation that relies on the documented exit-code contract can therefore publish rejected content, making this a fail-open defect in the skill's central release-gating function.
