Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese course-generation workflow that uses scoped local files and a read-only verifier, with no evidence of hidden network, credential, persistence, or destructive behavior.
Install this only if you are comfortable with a Chinese-language workflow that reads user-selected course materials and writes generated course files locally. Review the output directory before archiving, and only run the self-test if you are intentionally validating the verifier rather than generating a course.
The skill references development self-test behavior that creates temporary directories, copies files, mutates artifacts, and runs fault-injection style checks, yet this is not cleanly separated from normal operational behavior. If an agent follows these instructions inappropriately, it could modify or replicate local data beyond the user's intent, especially because the skill also has file and shell capabilities.
The skill references development self-test behavior that creates temporary directories, copies files, mutates artifacts, and runs fault-injection style checks, yet this is not cleanly separated from normal operational behavior. If an agent follows these instructions inappropriately, it could modify or replicate local data beyond the user's intent, especially because the skill also has file and shell capabilities.
Referenced artifact was not completely inspected
- 验收会执行本 Skill 内的 `verify.sh` / `verify_course.py` 读取课程文件；脚本不联网、不安装依赖、不修改课程文件。`verify_selftest.py` 仅在开发验收时写入并自动清理系统临时目录。
Referenced artifact was not completely inspected
- 验收会执行本 Skill 内的 `verify.sh` / `verify_course.py` 读取课程文件；脚本不联网、不安装依赖、不修改课程文件。`verify_selftest.py` 仅在开发验收时写入并自动清理系统临时目录。
The file title is written as "变更日志", indicating the skill documentation is presented in Chinese only. This is a natural-language locale constraint, and the changelog does not offer any user choice or opt-in for language, nor does it document a justified region-specific limitation.
The skill declares file read/write and shell-like behavior in its instructions, but does not define an explicit tool scope or permission boundary. That creates an authorization ambiguity: an agent may execute local file operations or shell commands more broadly than the user expects, increasing risk of unintended file access, overwrite, or command execution.
This manifest-style YAML template uses Chinese exclusively in user-facing comments and embeds Chinese-specific example directory/file names such as '课程知识库', '课程体系', and '培训方案'. That creates an implicit language/locale requirement without offering a user choice or documenting that the skill is intentionally restricted to a Chinese-language context.
The file title and all drafting requirements are written as a Chinese-only prompt, and the content specifies Chinese length/count standards such as '2500-3500 个中文字', which indicates the skill is intended to force Chinese output. There is no opt-in or user language-selection mechanism documented, so this creates a language policy concern.
标题及全文指令均以中文表述，且未说明这是面向特定中文区域或合规场景的限定，也未给出语言选择或用户 opt-in。按规则，强制特定语言而无明确理由，属于自然语言层面的语言/locale 政策风险。
The file title and all instructions are written as a Chinese-only course-outline prompt, and the required output format mandates Chinese section labels such as "课程标题", "来源索引", and "输出计划". This imposes a specific language/locale on the generated result without any user opt-in or explanation that the skill is limited to a Chinese-language context.
The file's instructions are written entirely in Chinese and prescribe a Chinese output structure such as '总览' and numbered Chinese section headings. This effectively forces a specific language/locale for generated content, and the file does not mention any user opt-in or a documented region-specific justification.
This shell script presents all diagnostic output in Chinese, including dependency and version failure messages. For a general-purpose verifier entrypoint, forcing a single language without user opt-in can violate language/locale policy and reduce usability for users expecting another language.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if ! command -v python3 >/dev/null 2>&1; then
echo "❌ 缺少系统依赖: python3" >&2
echo " macOS: brew install python" >&2
echo " Linux: sudo apt-get install python3" >&2
exit 2
fi
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if ! command -v python3 >/dev/null 2>&1; then
echo "❌ 缺少系统依赖: python3" >&2
echo " macOS: brew install python" >&2
echo " Linux: sudo apt-get install python3" >&2
exit 2
fi
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_verifier(root: Path) -> tuple[int, dict]:
completed = subprocess.run([sys.executable, str(VERIFIER), str(root)], check=False, capture_output=True, text=True, timeout=20)
lines = [line for line in completed.stdout.splitlines() if line.strip()]
if not lines:
raise AssertionError(f"验收器无 stdout，stderr={completed.stderr!r}")
This manifest schema hard-codes allowed type values as Chinese-language labels only, which imposes a specific language/locale constraint in a natural-language field. Because the file does not indicate that this is optional, user-selectable, or justified as a region-specific requirement, it can violate language/locale policy expectations.
The file header comments are written entirely in Chinese and provide no indication of language choice or alternative locale. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified.