Security audit
Security checks for vulnerabilities and agentic risk
This skill appears non-destructive, but its bundled script contains under-disclosed local audit and pattern-scanning modes beyond the advertised citation-tracing purpose.
Review before installing. The advertised citation workflow is local and non-destructive, but the package should either remove or clearly document the dormant audit and pattern-scanning modes, and users should only run it on intended files with a deliberate output path.
声明描述聚焦于文献来源管理与引用映射，但代码未实现任何与引文解析、来源去重、原始出处追踪、或一手/二手来源判别相关的逻辑。相反，代码通过 spec['mode'] 驱动多种通用审计功能，包括目录内容扫描、CSV 字段统计、正则模式安全扫描，以及对 Skill 目录完整性的检查。这些行为与“建立引用索引和原始出处映射”的主要目的存在实质性偏差，属于不同的工具类别。虽然代码不请求额外权限，且是本地文件处理，但其核心能力与声明用途明显不符，因此应判定为描述与行为不匹配。
The implementation materially diverges from the declared skill purpose of building source/citation trace mappings and instead provides multiple generic auditing/reporting capabilities. This creates a capability-mismatch risk: users or orchestrators may grant or invoke the skill under a narrower trust model while it can inspect directories, scan files, and audit unrelated content, increasing the chance of unintended data access or misuse.
The trigger examples are broad natural-language phrases such as asking to build a source index or distinguish primary and secondary sources, which plausibly overlap with normal user requests outside a narrowly scoped invocation flow. This can cause accidental skill activation and unintended processing of user content, but in this skill's context the documented behavior is read-oriented and non-destructive, so the security impact is limited.
The skill advertises executable capabilities via python3 and references local resources that imply file read/write behavior, but it does not declare an explicit tool/permission scope. This creates an authorization ambiguity: a caller or orchestrator may permit broader filesystem or shell access than users expect, increasing the risk of unintended command execution or file modification.
The manifest description and routing examples combine Chinese and English, while the skill title and core instructions are primarily in Chinese. This can impose a language/locale expectation on users without explicit opt-in or a documented reason that the skill is region- or language-specific.
This markdown example presents all user-facing content in Chinese, and there is no indication that the language was selected by the user or that alternative locales are supported. The policy explicitly flags language or locale constraints when a skill forces a specific language without user opt-in.
The title, category label, summary, input hint, sections, examples, and risk text are all presented only in Chinese. This can amount to a language-policy violation if the broader environment expects language choice or user opt-in, because the skill implicitly forces a specific language without documenting that constraint.
The template is entirely written in Chinese and gives no indication that language selection depends on user preference or locale. In a general-purpose agent skill, this can override or conflict with the user's expected language, causing misleading outputs, reduced usability, and possible downstream workflow errors when users assume the response will follow their requested language.
This code generates user-facing report text entirely in Chinese, including headings, summaries, and action guidance. Because the script does not offer a language selection or explain that it is intentionally region-specific, it violates the locale-choice policy for natural-language behavior.
The generic pattern scanner can read arbitrary files or recursively scan directories for secrets, shell patterns, and private URLs, which is unrelated to citation tracing. In the context of a research/source-mapping skill, this hidden broader inspection capability is dangerous because it can expose sensitive content from local workspaces beyond what a user would reasonably expect this skill to process.
The skill package/frontmatter auditing logic is unrelated to source provenance mapping and adds hidden reconnaissance capability over local directories and metadata. While not overtly destructive, it broadens what the skill can inspect and report on, violating least surprise and potentially leaking project structure or metadata in environments where the skill is trusted only for citation workflows.
该 README 从标题到功能、用法与风险提示均固定使用中文，未见提供语言选择、用户偏好继承或明确的区域性适用说明。若组织要求技能不得默认强制单一语言而应提供选择，这可能构成语言/locale 策略风险。
No suspicious patterns detected.
