Security audit
Security checks for vulnerabilities and agentic risk
This skill is mainly a local screenshot-text organizer, with no network, persistence, or hidden execution, but it ships some dormant audit code that is broader than the stated purpose.
Install only if you expect a Chinese-language local helper that organizes screenshot-derived text or OCR summaries into reviewable task lists. Provide only the files or text you intend it to read, keep the bundled spec in structured_brief mode, and treat the dormant audit functions as code that should be removed or documented before broader use.
声明描述的是“从截图中整理任务/备注/优先级”的能力，核心应涉及图像输入、截图内容解析，至少应有 OCR 后处理或面向截图文本的任务抽取逻辑。但实际代码只接收本地路径或内联字符串，读取文本/代码/CSV/目录，依据 spec 中配置的 mode 生成审计类报告。代码包含 directory_audit、csv_audit、pattern_audit、skill_audit 等明显与截图待办整理无关的功能，还会扫描疑似 secret、危险 shell 命令、私有 URL 等安全模式。这表明其主要用途是通用内容审计/扫描器，而非截图任务整理工具，因此描述与实际行为存在明显且实质性的偏差。
The code implements repository/file enumeration, file content sampling, markdown heading extraction, CSV inspection, pattern scanning, and skill structure auditing, none of which are justified by a screenshot-to-task skill. In context, this is more dangerous because users would not expect a screenshot organizer to traverse arbitrary local directories and inspect files, creating a trust-boundary violation and unnecessary exposure of sensitive workspace data.
The script’s core dispatcher supports multiple unrelated audit modes such as directory, CSV, pattern, and skill auditing instead of a narrowly scoped screenshot-to-task workflow. This capability mismatch is dangerous because it enables broad local file inspection and report generation that exceeds the declared purpose, increasing the chance of unintended data access and misuse in environments where users trust the skill to process screenshots only.
The trigger examples are short, generic natural-language phrases like '把这些截图内容整理成任务' and '帮我标优先级', which can overlap with ordinary conversation and cause the skill to activate when the user did not explicitly intend to invoke it. In a routing system, this can lead to misfires, unintended processing of screenshot-derived content, and accidental handling of sensitive notes or personal data.
The skill advertises executable capability via python3 and references reading local resources and producing output files, but it does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization gap: a host may expose shell, file read, and file write capabilities without a clear least-privilege contract, making unexpected filesystem access or command execution harder to govern and audit.
This markdown example output is entirely structured in Chinese, which implies a fixed output language. Under the policy rule, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
The generated report strings are hard-coded in Chinese, such as '结果', '摘要', and '下一步', with no option for the user to choose language or locale. This creates a language-policy issue because the skill enforces a specific language regardless of user preference or context.
The pattern scanner searches files for secrets, private URLs, and risky shell command patterns, which means the skill can inspect arbitrary local content for sensitive indicators unrelated to its stated function. Although it does not exfiltrate data by itself, this hidden inspection broadens data exposure and could surface or normalize access to credentials and internal information under misleading skill branding.
The manifest description and heading/instructions present the skill in Chinese while also embedding English phrases, but nowhere states that the user can choose their preferred language. This can violate a language/locale policy when a skill implicitly forces or defaults to a language without opt-in.
This markdown file presents all instructions and test criteria in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
No suspicious patterns detected.
