Security audit
Security checks for vulnerabilities and agentic risk
This skill locally generates and reviews QZTC teaching manual documents from user-provided Excel and Word files, with no evidence of hidden network access, credential use, or destructive behavior.
Install only if you intend to use it for the QZTC-style Chinese teaching manual workflow. The input spreadsheets and generated Word documents contain student records and grades, so run it only on trusted local files and keep outputs in appropriate protected locations.
The skill documents executable commands and clearly implies file read/write behavior, but it does not declare any tool scope such as permissions or allowed-tools. In an agent environment, this can lead to overbroad filesystem access, making unintended reads or overwrites more likely if the skill is invoked with elevated defaults.
The manifest description and main heading are entirely in Chinese and present the skill as a general-purpose teaching manual generator, but they do not state that Chinese is optional or that the tool is restricted for a documented locale/compliance reason beyond internal organizational use. This creates a natural-language locale constraint without user opt-in, which matches the policy-violation category.
The module name/comments/docstrings are entirely in Chinese, including the user-facing configuration file header written later by this code. Under the policy, forcing a specific language without opt-in or a documented region-specific justification is a natural-language locale violation.
This Python file contains user-facing natural-language text entirely in Chinese, beginning with the module docstring and continuing through the CLI help and status output. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the constraint is explicitly justified as region-specific, which is not stated here.
This Python file contains natural-language instructions and descriptions entirely in Chinese, including the top-level docstring and usage guidance. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation unless the restriction is explicitly justified, which is not present here.
The script prints status, usage, warnings, and errors only in Chinese, which enforces a single language for user interaction. The file does not provide a language flag, locale detection, or documented justification for this restriction.
No suspicious patterns detected.
