Security audit
Security checks for vulnerabilities and agentic risk
This skill is a claim-review helper, but it can read the user's clipboard on broad prompts without an explicit confirmation step.
Review before installing. Only use this skill when you intentionally want the agent to read the current macOS clipboard, and avoid invoking it while passwords, tokens, private notes, or unrelated confidential text may be copied.
The changelog content is entirely in Chinese, indicating a language-specific presentation without any visible user choice or justification in this file. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
The skill description is entirely written in Chinese and presents the skill's functions and usage scenarios only in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-language context. This creates a natural-language locale constraint without user opt-in or documented justification.
The invocation phrases are broad, natural-language requests that a user could say in ordinary conversation, which increases the chance of accidental or overly eager triggering. In combination with the skill’s clipboard-reading behavior, unintended activation could cause the agent to access and process clipboard contents the user did not explicitly mean to share in that moment.
The skill instructs the agent to read the system clipboard via a script without any user-facing warning or explicit consent prompt at the point of access. Clipboard contents often contain sensitive data such as passwords, tokens, personal information, or proprietary text, so silent access creates a real privacy and data-exposure risk.
This script reads arbitrary clipboard contents via pbpaste even though the skill’s stated purpose is auditing text claims, not collecting data from the user environment. Clipboard contents often contain passwords, tokens, private drafts, or other unrelated sensitive material, so silently sourcing input this way expands access beyond what is necessary and can expose data unintentionally.
The code consumes clipboard data without any prior warning, consent flow, or disclosure to the user. Because clipboard data is frequently sensitive and may be unrelated to the task, this creates a privacy risk and could leak confidential information into logs, downstream processing, or the agent workflow.
Natural-language instructions and trigger phrases are entirely in Chinese, which can amount to forcing a specific language if the broader environment is not explicitly Chinese-only. The file does not state that the skill is region-specific or provide an opt-in or alternative language option.
The script invokes an external command with execSync to access clipboard data, but there is no confirmation prompt, explanatory comment, or user-facing notice about running a subprocess. Under the code-file warning criteria, subprocess execution should have some visible disclosure unless clearly covered by the skill description.
The error message is hardcoded in Chinese, which imposes a specific language on users without any indication that the skill is region-specific or that other languages are supported. This matches the policy-violation category for forced language or locale without user opt-in.
