Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only workflow skill that transparently tells agents to execute, verify, and report work rather than claim completion without evidence.
Install this if you want agents to give evidence-backed status reports. Keep normal safeguards for destructive commands, permission changes, services, and network checks; the EVR process should not replace asking for confirmation when a task has real side effects.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
✅ EVR正确方式:
🔧 Execute
$ rm /path/to/file.txt
[无输出，命令成功]
✅ Verify
The title explicitly presents the skill as an AI tool in Chinese ("AI三步法工具"), indicating a fixed language/locale expectation. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified regional constraint is documented, which is not present here.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 步骤 | 含义 | 命令示例 |
|------|------|---------|
| 🔧 **Execute** | 实际执行 | `chmod 600 file` |
| ✅ **Verify** | 验证结果 | `stat -c "%a" file` → `600` |
| 📋 **Report** | 完整汇报 | "权限已修改: 644→600, 验证通过" |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 步骤 | 含义 | 命令示例 |
|------|------|---------|
| 🔧 **Execute** | 实际执行 | `chmod 600 file` |
| ✅ **Verify** | 验证结果 | `stat -c "%a" file` → `600` |
| 📋 **Report** | 完整汇报 | "权限已修改: 644→600, 验证通过" |
The top-level description states the skill in Chinese and frames it as a mandatory workflow tool, but nowhere in the file does it offer the user a choice of language or explain a region-specific need for Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The integration snippet prescribes required behavior entirely in Chinese and says all tasks must follow it, but does not indicate that users or downstream agents may choose another language. This creates a language-policy issue because the enforced instructions are locale-specific without opt-in or justification.
The file is explicitly titled as an English README and links to a Chinese version, but it does not present language selection as a user choice within the skill behavior or documentation flow. This can be read as a locale/language policy preference embedded in the documentation rather than an opt-in choice.
No suspicious patterns detected.