Security audit
Security checks for vulnerabilities and agentic risk
The skill’s normal configured behavior is a Chinese sales-lead note generator, but its bundled script contains under-documented local audit and pattern-scanning capabilities that do not fit that purpose.
Review this skill before installing. It appears safe from remote-code, persistence, and exfiltration behavior, but its script includes local audit/scanning code beyond lead-note generation. Use it only with intended lead files, choose output paths deliberately, and avoid granting it broad filesystem access unless those extra audit capabilities are removed or explicitly documented and scoped.
声明描述强调的是面向销售线索信息的整理与资格判断输出，属于特定业务场景的 lead qualification 助手。但实际代码并未实现任何销售线索专属逻辑，也没有固定提取‘资格判断、关键问题、风险项、下一步建议’所需的业务规则。相反，它从 resources/spec.json 读取配置后，作为一个通用报告器运行，支持 directory_audit、csv_audit、pattern_audit、skill_audit、structured_brief 等多种模式。代码还能扫描目录、读取 CSV、匹配潜在危险命令和疑似密钥、检查 Skill 文件完整性与 frontmatter，这些能力都明显超出并偏离了已声明的销售线索整理用途。因此描述与实际行为存在实质性不一致。
The script’s implemented behavior is substantially different from the declared sales lead-qualification purpose: it can audit arbitrary directories, inspect CSVs, scan files for security-like patterns, and validate skill package structure. This scope mismatch is dangerous because it enables broad local file inspection under a misleading skill identity, increasing the risk of unintended data access and deceptive operator trust.
The pattern scanning functionality reads arbitrary files and searches them for secrets, internal URLs, and command-execution patterns, which is unrelated to sales note generation. In the context of a CRM/lead skill, this is an unjustified capability expansion that can expose sensitive local content or be used to quietly inventory security-relevant information from user-accessible paths.
The entire skill documentation is written in Chinese and presents the skill as Chinese-language only, with no indication that users may choose another language or that the limitation is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The trigger section gives example invocations like “帮我判断这条线索值不值得继续跟” and “生成下一步问题清单,” but it does not define clear activation boundaries, constraints, or negative examples. These phrases are generic sales-assistance requests and may cause unintended invocation in normal discussion of leads or meeting prep.
The skill declares executable capabilities via metadata and documented shell usage but does not define an explicit tool/permission scope. That creates ambiguity about what the skill is allowed to access or modify, which weakens containment and reviewability if the host agent maps implicit capabilities too broadly.
The documentation explicitly authorizes shell/exec of a Python script for a task that should be achievable as pure text transformation. Enabling command execution in a note-organizing skill increases the attack surface for prompt-to-exec abuse, unsafe file handling, and unintended local system interaction without a clear business need.
The skill states a default read-only safety boundary while also permitting script execution and output-file generation, which is internally inconsistent. This can mislead reviewers and users about the real risk profile, making it easier for write or execution side effects to occur under the guise of a low-risk documentation skill.
This markdown file is entirely written as a Chinese-language skill input and includes output requirements in Chinese, with no indication that the user may choose another language or locale. Under the policy rule for natural-language violations, a skill that effectively fixes a language without opt-in can violate organizational language/locale requirements.
This code emits user-facing report text such as headings, summaries, and action prompts entirely in Chinese. Because the file is a code file and the language is forced without any user opt-in or documented regional justification, it matches the language/locale policy violation category.
The directory and CSV report functions generate multiple user-visible headings and guidance strings exclusively in Chinese. This repeats the same locale restriction across major execution paths without presenting a language choice or indicating that the tool is region-specific.
These functions produce user-facing audit results, errors, and remediation prompts solely in Chinese. The code therefore consistently enforces a specific language across the skill without user choice, which is a natural-language policy violation under the stated rule.
The skill_audit path inspects arbitrary directories for expected files, parses SKILL.md frontmatter, and reports package metadata despite the skill being presented as a sales/CRM note helper. This hidden auditing behavior broadens filesystem visibility and may collect implementation details from unrelated projects, making the mismatch more dangerous because users would not reasonably expect this access from the declared use case.
This markdown template is entirely written in Chinese and presents fixed Chinese section headings and instructions, which implies the skill output is expected in a specific language. The file does not offer the user a language choice or explain a justified region-specific requirement, so it may violate the language/locale policy criteria.
No suspicious patterns detected.
