Security audit
Security checks for vulnerabilities and agentic risk
This skill is mainly a Chinese-language stakeholder update drafter, with some unused local-audit code in its script that users should be aware of but that is not active under the bundled configuration.
Install this if you want a Chinese-language helper for drafting stakeholder status updates from material you provide. Review generated drafts before sending them, avoid feeding sensitive personal or confidential data unless appropriate, and note that the packaged script contains unused local-audit functions that should remain inactive unless the spec is changed.
声明描述的是一个沟通写作类技能：根据同一事实生成不同受众版本的项目更新。实际代码并未体现“老板版/客户版/执行版/风险透明版”这类特定输出逻辑，也没有任何面向利益相关方改写、语气控制、风险透明校验或项目更新专用流程。相反，它是由 spec.json 驱动的通用报告生成与审计工具，支持目录审计、CSV 分析、模式安全扫描和 Skill 规范检查等明显超出声明范围的能力，并会访问本地文件系统中的文件与目录内容。这些属于未声明且主用途 materially different 的能力，因此描述与行为不匹配。
The implementation materially exceeds the stated purpose of a stakeholder-update drafting skill by adding directory enumeration, CSV inspection, regex-based pattern scanning, and skill auditing. This capability mismatch is dangerous because it can be used to inspect local repositories and summarize potentially sensitive file contents under the cover of an innocuous communication tool, violating least privilege and user expectations.
Regex-based security scanning is unrelated to the declared stakeholder communication workflow and enables the skill to search arbitrary files and directories for secrets, private URLs, and risky shell commands. In this context, the mismatch makes the feature more dangerous because a user may invoke the skill expecting text drafting while it instead performs local content inspection that can expose confidential material in generated output.
The trigger examples are broad, natural-language phrases that can overlap with ordinary user requests, increasing the chance the skill is invoked unintentionally. In a communication-drafting skill, accidental activation can cause the system to reframe sensitive project facts into audience-specific narratives without the user explicitly requesting that transformation, which may lead to miscommunication or inappropriate disclosure emphasis.
The skill declares executable and file-access capabilities in practice, including a shell invocation of python3 and references to reading local resources, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authority/visibility gap where downstream systems or reviewers may not realize the skill can read/write files or invoke shell commands, increasing the risk of unintended local access or command execution.
The manifest description and the full skill content are predominantly in Chinese, which effectively forces a specific language for users. Under the policy, language constraints should be optional or clearly justified; no user choice or opt-in is provided here.
This markdown example output forces a single language/locale presentation across the whole file, with headings and instructional text only in Chinese. Under the policy, language-specific behavior should either offer user opt-in or clearly document why the locale restriction is required.
The title, category label, summary, input hint, sections, examples, and risk text are all specified only in Chinese, which indicates a fixed language/locale for the skill experience. The policy for this category says to flag language or locale constraints when the skill does not explicitly offer user opt-in or choice.
This markdown template presents all user-facing instructions and section headings in Chinese only. Under the policy rules, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
This code generates user-facing report content entirely in Chinese, including headings, prompts, and next-step guidance. That imposes a specific language on users with no option to choose another locale, which matches the language/locale policy violation criteria.
The skill-audit/compliance logic inspects filesystem structure and parses metadata files, which is outside the expected behavior of a stakeholder-update drafting tool. While less directly harmful than secret scanning, it still expands the skill into local package reconnaissance and can disclose repository layout, missing files, and metadata details without clear justification from the skill’s declared purpose.
该技能说明从标题到用法均仅以中文呈现，体现出默认且单一的语言/locale 约束，但文档未说明这是面向特定中文场景的限定，也未提供用户可选择其他语言的选项。根据规则，未给出 opt-in 或合理地域性说明的强制语言约束属于自然语言策略问题。
The file is entirely written as a Chinese-language example input and does not indicate that language selection is optional or user-driven. Under the policy rule for natural-language violations, a skill that effectively imposes a specific language without opt-in can be considered a locale-policy issue unless the regional constraint is clearly documented and justified.
No suspicious patterns detected.
