Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a disclosed local Markdown indexing tool, but its mutable workspace configuration can redirect later scans to other readable local folders without a fresh authorization check.
Install only if you are comfortable with a local tool that scans and stores metadata about Markdown and other files under its configured source roots. Keep the .ai-workbench/workbench.json file protected, and recheck configured source paths before update or scan operations, especially in shared or writable workspaces.
scripts/runtime/workbench/config.py:111Mutable configuration permits scanning outside the user-authorized source boundary
scripts/runtime/workbench/doctor.py:156Environment diagnosis exposes host details beyond minimum functional requirements
The 'When to Use' section is written in Chinese and directly instructs when the skill should be used, but the file does not offer the user a language/locale choice or explain that the locale is intentionally region-specific. This creates a natural-language locale policy issue because the skill imposes a specific language for key operational guidance without opt-in.
The display name, short description, and default prompt are written entirely in Chinese, which indicates a fixed language/locale expectation. The file does not provide any user opt-in, alternative language choice, or justification that this skill is intentionally region-specific, so it may violate language/locale policy requirements.
This code generates multiple output paths and filenames using Chinese text such as "00-入口.md", "10-索引", and "待审核.md". That imposes a specific language/locale in the generated artifact structure without any visible user opt-in or justification, which matches the language/locale policy concern.
The configuration defines fixed non-English folder names such as "10-索引" and "80-待审核", which imposes a specific language/locale in the generated workspace structure. The file does not provide any user opt-in, alternative locale selection, or documented justification for this locale constraint.
This code file contains natural-language and locale settings that explicitly fix the document language to zh-CN, and the surrounding interface text is predominantly Chinese. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless it is clearly justified as region-specific, which is not documented here.
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.
url_host = f"[{host}]" if ":" in host else host
health_url = f"http://{url_host}:{port}/healthz"
try:
with urlopen(health_url, timeout=0.75) as response: # noqa: S310 - loopback URL is validated above
health = json.loads(response.read().decode("utf-8"))
except (OSError, URLError, ValueError, json.JSONDecodeError) as exc:
return make_result(
The generated report path hard-codes Chinese directory and file names ("99-系统/质量报告.md"), which imposes a specific language/locale choice in the skill behavior. There is no indication in this file that the user can choose the report language or that the locale restriction is documented as region-specific.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
actual_port = int(server.server_address[1])
service = {
"status": "running",
"pid": __import__("os").getpid(),
"instance_id": instance_id,
"host": selected_host,
"port": actual_port,
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
The README is primarily written in Chinese and only provides a brief English quick start at the end. Under the stated policy, forcing a specific language without explicit user opt-in can be a natural-language policy violation unless a justified locale constraint is documented, which is not present here.
Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
The function reads platform-specific environment variables (LOCALAPPDATA and PROGRAMFILES) to locate an Obsidian installation, and later also reads SHELL/COMSPEC for platform reporting. In this file there is no user-facing print/log, comment, or docstring explaining that environment-derived system information will be inspected and included in diagnostic output.
The code writes a generated markdown report to a path containing Chinese directory and file names ("99-系统/质量报告.md") without any visible user opt-in or locale selection. For a general-purpose skill, this can impose a specific language/locale convention on outputs, which falls under the policy's natural-language locale concerns.
No suspicious patterns detected.