Security audit
Security checks for vulnerabilities and agentic risk
The skill mainly behaves like a project-brief writer, but its bundled script contains under-disclosed local audit and secret-pattern scanning modes outside that purpose.
Review before installing if you only want a narrow brief-writing skill. In the published configuration it generates structured Markdown from user-provided material, but the bundled script also contains broader local audit and secret-pattern scanning code that should not be enabled or used on private directories without explicit user intent and careful scoping.
声明描述的是一个面向需求整理和项目任务书生成的工具，这与代码中的 structured_brief 模式部分吻合。但实际代码的核心行为由 spec.json 的 mode 决定，支持 directory_audit、csv_audit、pattern_audit、skill_audit 等多种审计/扫描能力。这些能力明显超出并偏离了“整理需求/会议内容为项目任务书、边界、验收标准和风险清单”的声明范围，且涉及本地文件系统遍历、内容读取、模式匹配和技能包规范检查等未声明功能。因此描述未准确覆盖代码实际能力，存在实质性不匹配。
The regex-based pattern scanner searches arbitrary files for secrets, private URLs, and risky shell constructs, which is not justified by the skill's project-brief authoring purpose. Even though matches are truncated or partially masked, the tool still reads and reports sensitive content from local files, creating an unnecessary data exposure path and covert repo-scanning capability.
The dispatcher enables multiple operational modes—directory audit, CSV audit, pattern scan, and skill audit—that materially exceed the stated purpose of a project-brief writer. This broadens the skill into a local filesystem inspection tool, increasing the chance that users invoke it on sensitive repositories or data and receive extracted structural or secret-adjacent output unrelated to the declared workflow.
The trigger examples are broad and do not clearly state exclusion criteria or narrow activation conditions, which can cause the skill to be invoked for loosely related requests. In an agent setting, ambiguous routing increases the chance of unintended processing of user content, including sensitive project material, under the wrong workflow.
The skill exposes operational capabilities implying file read/write and shell execution, but it does not declare an explicit tool scope such as permissions or allowed-tools. This creates a governance gap: reviewers and runtimes may underestimate what the skill can access or execute, increasing the chance of unintended command execution or file modification through prompt-driven behavior.
The documentation claims the skill is default read-only and should favor review or dry-run output, yet it explicitly permits shell/exec via a local Python script. That inconsistency can mislead operators into trusting the skill as non-executing while it still has an execution path, which expands the attack surface for prompt-influenced local command use.
The entire example output is written in Chinese and presents a fixed-language template, but the file does not indicate that language choice is optional or limited to a justified Chinese-language context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The title, category label, summary, examples, and risk text are all presented in Chinese, indicating a fixed language/locale for the skill. The file does not offer a language choice or explain that the skill is intended only for a Chinese-speaking or region-specific context, which violates the language/locale policy criteria.
The template content is entirely in Chinese and the title indicates a fixed output template for the skill, which implies a language constraint on generated content. The file does not offer a language choice or document that the skill is intentionally limited to Chinese for a justified regional or compliance reason.
The generated report strings are written in Chinese literals such as '结果', '摘要', and '下一步', which forces a specific language for user-facing output. The file does not offer a language/locale option or document that the skill is intentionally region-specific, so this is a natural-language policy violation under the locale-choice rule.
Directory enumeration and skill-package auditing functions inspect local files, summarize directory contents, and extract Markdown headings from sampled files, none of which are necessary to convert notes into a project brief. In this context, they create unnecessary visibility into repository structure and content, which can leak sensitive project names, filenames, or embedded text to the output.
The directory report uses Chinese-only headings and guidance such as '扫描报告', '目录概览', and '给出人工审阅意见'. Because these are user-visible outputs and there is no opt-in or locale configuration, the script imposes a single language across another major code path.
The CSV reporting path presents headings and guidance in Chinese, including '数据报告' and '字段概览', and similarly the skill audit path uses Chinese status text. This creates a forced locale experience without providing the user a choice or explaining a justified locale limitation.
The markdown content is entirely written in Chinese and specifies expected output sections in Chinese, which indicates a language constraint for using or validating the skill. There is no visible opt-in, alternative language option, or justification that this skill is intentionally limited to a Chinese-language or region-specific context.
SQP-3 适用于所有文件类型。该技能说明全文以中文呈现，技能名称与各节标题也均固定为中文，但未声明支持用户选择语言，也未说明这是特定区域或合规场景限定，存在语言/locale 策略约束未显式 opt-in 的问题。
The file's headings and instructions are entirely in Chinese, which can impose a specific language on users without any stated opt-in or justification. Under the policy rule for natural-language violations, forcing a language or locale without user choice is reportable.
No suspicious patterns detected.
