专家工具箱

• Risk level: Low
• Analyzed: Apr 18, 2026, 2:10 PM
• Findings: 0
• Version: 1.1.1

Overview

The skill's code, configs, and runtime instructions are coherent with its stated purpose (indexing and returning local 'expert' role prompts) and do not request unrelated credentials or installs; review local role files before use and avoid pointing the skill at sensitive directories.

This skill is coherent with its description: it loads local 'expert' markdown files, indexes and matches them, and returns text. Before installing or using it: 1) Verify the expert-role files you place under the roles directory come from trusted sources (prompts can contain instructions or sensitive content). 2) Avoid setting EXPERT_TOOLKIT_ROLES_ROOT to system or sensitive directories (that would let the skill read unrelated files). 3) If you expect the skill to call external services, inspect the remaining parts of scripts/expert_toolkit.py for network calls — the inspected portions show only file reads/formatting. 4) If you will use third-party role packs (e.g., from GitHub), scan them for prompts that ask for secrets or to contact external endpoints before adding them to your roles folder.