Security audit
Security checks for vulnerabilities and agentic risk
The skill mainly behaves like a customer success plan generator, but it ships under-disclosed local audit and pattern-scanning code that does not fit that purpose.
Review before installing because the package contains more local audit code than its success-plan description suggests. If you install it, use it only on intended customer-success inputs, avoid pointing it at broad directories or sensitive repositories, and prefer dry-run/stdout unless you explicitly want a local output file.
声明描述的是一个面向客户成功场景的“成功计划生成器”。但实际代码没有任何特定于 B2B success-plan、里程碑绑定、可验证结果设计或复盘节奏编排的业务逻辑。相反，它实现的是一个由 spec 驱动的通用本地分析/审计工具：可扫描目录、分析 CSV、匹配风险模式、检查 Skill 文件结构，并生成审计报告。虽然在某些 spec 配置下也可能输出结构化文本，但其主要能力和默认支持范围明显偏向通用审计/扫描，而非客户成功计划生成。因此，代码的实际行为与声明用途存在实质性不一致。
The code can enumerate arbitrary local directories, read text-like files, extract markdown headings, summarize CSV contents, and inspect repository structure. Those capabilities exceed the documented success-plan use case and create a broad local file inspection surface that may reveal sensitive business, operational, or repository information unrelated to the user's intended workflow.
The script implements a pattern-scanning and security-auditing workflow, including regex searches for secrets, dangerous shell usage, and private URLs, which is materially different from the declared purpose of generating B2B customer success plans. In skill ecosystems, capability mismatch is dangerous because users may grant access or provide paths expecting business-content generation, while the skill instead inspects local files and repositories, increasing the chance of unintended data exposure or repurposing for local reconnaissance.
The trigger examples are broad natural-language phrases such as '给这个客户做一份 success plan' and '把里程碑和结果绑定', which can overlap with ordinary conversation about customer planning. In an agent environment with automatic skill routing, this can cause unintended invocation on unrelated prompts, leading to misleading drafted outputs or processing of sensitive customer material without clear user intent.
The skill explicitly references shell execution via python3 "{baseDir}/scripts/run.py" and implies file input/output, but it does not declare any permissions or allowed-tools scope. This creates a capability transparency gap: operators and policy layers may treat the skill as low-risk text generation while it can actually invoke local execution and write outputs, increasing the chance of unintended code execution or data access.
The manifest description and the main instructional content are written entirely in Chinese, presenting the skill as operating in that language by default. There is no natural-language instruction offering locale selection or user opt-in, which can violate language/locale policy when the skill is user-invocable.
The entire example input is written in Chinese and provides no indication that language selection is optional or limited to a documented Chinese-specific use case. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
This markdown example forces a specific language/locale in its natural-language content, and there is no indication that the user can opt into Chinese or choose another language. Under the policy, language constraints should be optional or clearly justified as region-specific.
Multiple user-facing report strings are emitted only in Chinese, such as headings and guidance text. This enforces a specific language/locale for users with no documented choice or opt-in, which matches the language/locale policy violation category.
Embedding secret-detection and dangerous-command regex scanning into a customer success planning skill is context-inappropriate and expands the skill into security analysis of arbitrary local content. Even without exfiltration logic in this file, the scan results can surface sensitive snippets from user files to outputs or logs, which is unnecessary for the declared business function and raises confidentiality concerns.
整个 README 以中文编写，且未说明该技能是否支持其他语言、是否要求按中文输出，或是否允许用户选择语言/locale。根据规则，若技能在自然语言层面强制特定语言而无用户 opt-in，可能构成语言/locale 策略问题。
This manifest presents the skill title, category label, summary, and input hint only in Chinese, which can amount to a language-policy issue if users are not given an explicit language or locale choice. The file does not document that the skill is intended only for Chinese-speaking users or a specific region.
This markdown file presents all user-facing instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy for natural-language violations, forcing a specific language without opt-in can be a locale-policy issue.
No suspicious patterns detected.
