Security audit
Security checks for vulnerabilities and agentic risk
This is a local QA test-scenario generator with some broader inactive audit code, but I found no hidden execution, persistence, network exfiltration, or destructive behavior.
Install this if you want Chinese-language QA scenario drafts from local inputs. Run the script only on files you intend to share with the skill, avoid changing spec.json to audit modes unless you explicitly want local scanning, and redact sensitive requirements before use.
描述强调的是测试设计：把需求拆解为功能、异常、跨端、脏输入和恢复场景测试集。这通常意味着围绕产品需求生成 QA 测试用例。实际代码却是一个由 spec 驱动的通用本地分析/报告脚本，核心能力取决于 spec['mode']，包括 structured_brief、directory_audit、csv_audit、pattern_audit、skill_audit。虽然其中的 structured_brief 模式有可能被配置成输出某种测试场景结构，但代码本身并未专门实现“功能/异常/跨端/脏输入/恢复”测试集拆解逻辑，反而包含多项与声明无关的审计和扫描能力，尤其是目录扫描、CSV 审计、风险模式匹配、Skill 结构检查。因此代码的主要能力范围明显比声明更广，且主用途不够一致，构成描述与行为不匹配。
The script supports multiple audit-oriented modes such as directory, CSV, pattern, and skill-package auditing even though the declared skill is for QA scenario synthesis. This capability mismatch expands the skill's operational scope into repository inspection and security/compliance analysis, which can cause unauthorized data exposure, misuse of the skill for unintended scanning, and erosion of trust in the skill boundary.
The invocation examples "根据需求生成测试场景" and especially "补边界和异常路径" are fairly general phrases that could match ordinary conversation in testing contexts without clearly distinguishing when this specific skill should activate. The README does not provide tighter trigger constraints, explicit activation scope, or negative examples to reduce unintended invocation.
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language or locale without opt-in. This self-check document contains only Chinese text and does not indicate that language choice is optional or justified by a region-specific requirement.
The skill advertises executable behavior via python3 and references local input/output files, but it does not declare any explicit permissions or allowed-tools scope. This creates an authorization gap where a user-invocable skill may gain shell and file access without clear confinement, increasing the chance of unintended file reads/writes or command execution in downstream agents.
The entire skill file is written in Chinese and does not indicate that language selection is optional or limited to a China-specific or Chinese-language-only context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown file presents all headings and user-facing content exclusively in Chinese. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific requirement, which can violate language/locale policy constraints requiring user opt-in or documented limitation.
The title, category label, summary, and input hint are all specified only in Chinese, indicating the skill is intended to operate in a fixed language/locale. The policy for this category requires either user language choice/opt-in or a clearly justified locale restriction, neither of which is documented here.
The template is entirely written in Chinese and implicitly steers output into Chinese without any indication that language should follow user preference or explicit opt-in. This can cause unintended behavior, reduce usability for non-Chinese users, and create prompt-level misalignment where the assistant ignores the user's requested language.
This code generates user-facing report content entirely in Chinese, including headings, prompts, and next-step guidance. Because the file provides no option to select language and no justification that the skill is region-specific, it violates the locale-choice policy for natural-language behavior.
The directory and CSV report functions emit Chinese headings and guidance directly to users, again without any locale selection path. This reinforces that the skill forces a specific language across multiple modes instead of offering choice or documenting a justified restriction.
The regex-based scanning for secrets, private URLs, and dangerous shell patterns introduces a security scanning function unrelated to the stated QA test-scenario purpose. In this context, the danger is less about code execution and more about covert content inspection: the skill can enumerate sensitive-looking material from local files and include snippets in output, potentially exposing secrets or internal paths.
The skill-package compliance checks inspect repository/package structure and metadata that are outside the advertised QA scenario generation role. This broadens the skill into auditing local project contents and can reveal internal project layout, missing files, and metadata issues without that behavior being clearly declared to the user.
The markdown instructions and headings are entirely in Chinese, which imposes a specific language on users without any visible opt-in or justification. Under the policy rule, this is a natural-language locale/language constraint that should either be optional or explicitly documented as region-specific.
No suspicious patterns detected.
