Security audit
Security checks for vulnerabilities and agentic risk
This skill locally converts Chinese fonts for vertical reading and its file and script behavior matches that purpose.
Use this skill for local font conversion only, choose input and output paths deliberately, and review the generated previews before accepting the final font. Also make sure you have rights to modify the source font and use trusted sources if installing the expected Python libraries.
The skill clearly instructs use of local scripts, file reads/writes, and shell-capable workflow steps, but it does not declare any explicit tool scope or permissions boundaries. That makes the runtime authority implicit and increases the risk of over-broad file-system or command execution access if the skill is invoked in a more privileged environment than intended.
The hardcoded preview text is entirely Chinese-centric and includes a Chinese title, which imposes a specific language/locale in the generated output. The file does not offer an opt-in, alternative locale, or documentation that this is intentionally limited to a Chinese-specific use case.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd):
print('running:', ' '.join(str(x) for x in cmd))
result = subprocess.run([str(x) for x in cmd], check=False)
if result.returncode != 0:
raise SystemExit(result.returncode)
No suspicious patterns detected.