Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple GitHub publishing guide with no code execution, persistence, or hidden behavior, though users should review files before making a public repository.
Before using this skill, confirm you really want a Public GitHub repository and manually review every file for secrets, tokens, private data, or proprietary code. Use a private repository instead if the content is not meant for public release.
The README says to invoke the skill whenever publishing to GitHub is needed, but it does not define any approval, scope, or repository constraints. For a skill that can initialize Git, create repositories, and push code, this broad trigger increases the risk of accidental or unauthorized publication of local content.
The documented workflow includes creating a GitHub repository, adding a remote, and pushing code, but it does not warn that these actions may publish sensitive or proprietary material to a remote service. In a publishing skill, omission of publication-risk warnings is dangerous because users may unintentionally expose secrets, internal code, or private data.
The skill explicitly instructs the user to create a Public GitHub repository and upload local files, but provides no warning to review the contents for secrets, private data, or proprietary material before publishing. In this context, the danger is real because the skill’s purpose is code publication, and a user following it literally could unintentionally expose sensitive files or credentials to the internet.
The natural-language content is entirely presented in Chinese, and there is no indication that the user can choose another language or that the locale restriction is required for a specific regional purpose. This may violate language or locale policy where skills should not impose a language without opt-in or justification.
The skill description and operating instructions are entirely in Chinese, with no indication that the language is optional or that the skill is intended only for a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
No suspicious patterns detected.
