Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent PR-review purpose, but it can automatically create GitHub issues and retain review data without a clear confirmation gate.
Review this skill before installing. It is best used only where automatic GitHub issue creation is desired, GitHub permissions are narrowly scoped, and users understand that review findings may be saved locally in `.learnings/`. Prefer adding an explicit confirmation or dry-run step before issue creation and logging.
The workflow explicitly enables automatic GitHub issue creation but does not warn the user or require confirmation before modifying an external system. This creates a real risk of unauthorized or unexpected repository changes, spam issue creation, and disclosure of review findings into tracked systems if the workflow is triggered accidentally or with incomplete context.
The README explicitly describes automatic creation of GitHub Issues via gh api and writing learning records to .learnings/, but it does not warn that the skill may modify external systems or the local workspace. In an agent setting, this can lead to unintended side effects such as unauthorized issue spam, disclosure through issue content, or silent local file changes if a user expects read-only analysis.
The trigger list includes broad phrases like “代码审查” and “检查我的PR”, which can overlap with ordinary user requests and cause the skill to activate in situations the user did not clearly intend. Because this skill performs multi-step actions including external GitHub operations, ambiguous activation increases the risk of unintended review workflows and downstream side effects.
The usage examples define ambiguous activation boundaries by allowing generic requests such as “检查我的PR” without requiring a precise target or explicit consent for the full workflow. In context, this is more dangerous because the workflow chains multiple skills and may initiate repository inspection, issue creation, and local logging from a casual request.
The skill instructs automatic creation of GitHub Issues for each discovered problem but does not prominently warn users that it may modify remote repository state. This can lead to unintended spam, disclosure of internal review findings to collaborators, or unauthorized actions if the operator did not realize the workflow would create artifacts on GitHub.
The manifest presents the skill description, category, triggers, and step names primarily in Chinese, with only limited English trigger coverage, and does not state that the language is configurable or region-specific. This can violate language/locale choice expectations when users are not given an explicit opt-in or alternative locale.
The trigger phrase set includes broad, common requests such as '审查PR', '代码审查', and 'review PR', which can overlap with ordinary user intent and cause the workflow to activate unexpectedly. Because this workflow performs downstream actions including issue creation and logging, accidental activation can lead to unintended external side effects rather than a harmless suggestion.
This trigger is broad enough to match routine PR discussion, increasing the chance of unintended execution during everyday collaboration. In this workflow, accidental activation is more dangerous because it can cascade into repository analysis, external issue creation, and persistence of review-derived data.
The workflow sends findings and PR context to a 'self-improvement' step that records novel patterns into a learning file, yet it does not disclose this persistence behavior. That can result in retention of project-specific or sensitive review context beyond the immediate task, which is more concerning in a code-review pipeline handling repository metadata and issue counts.
The README presents the skill name, instructions, examples, and outputs entirely in Chinese, including the sample AI responses, with no indication that other languages are supported or that Chinese is required for a specific regional or compliance reason. That creates a natural-language locale constraint without user opt-in.
The note that self-improvement logs are stored in .learnings/ discloses persistent local storage, but the skill does not warn users up front that review-derived data may be retained. This is risky because PR contents, security findings, or repository metadata could be written to disk and persist beyond the session, creating privacy and data-handling concerns.
No suspicious patterns detected.
