Security audit
Security checks for vulnerabilities and agentic risk
This research helper needs review because its instructions reject stop orders and its completion checks can give misleading results.
Before installing, require cancellation and time or spending limits to override the research criteria. Treat validator results as advisory: nonconsecutive zero-yield rounds incorrectly pass convergence, and declared unresearched directions fail despite documentation saying they are accepted.
references/判据详解.md:56Research instructions prohibit honoring an explicit stop order
An agent following this instruction could continue unwanted research and tool use after authorization is withdrawn, consuming resources beyond the user's request.
The supplied script has a materially different primary purpose from the declared research tooling. It checks frontmatter name and description, directory-name consistency, SKILL.md length, allowed subdirectories, context: fork, and license presence. These are skill-package compliance checks, not the described research-journal checks. Its filesystem access is local and read-only, with no evident network activity or code execution. This assessment is limited to the supplied chunk; other skill components may implement the declared research features.
The script broadly matches the declared research-journal validation purpose, but the description explicitly advertises five criteria, S1–S5. S6 introduces an additional mandatory research-completion requirement rather than merely implementing those five checks. It can reject a journal independently of S1–S5, making the discrepancy material. The supplied code only reads the specified local file and reports findings; no network access, exfiltration, or unrelated execution is evident. Other advertised skill components cannot be assessed from this single code chunk.
Without declared permissions the skill's intent is opaque and cannot be validated.
L016–L017 explicitly state that exit code 0 includes directions marked as unresearched and that only missing declarations must be fixed. However, L138 counts every 'notdone' entry as a failure, and L146 returns exit code 1 even when all nine directions are declared with valid statuses. This changes the checker's documented policy from verifying disclosure of research coverage to requiring research completion.
The checker counts zero-yield rounds globally instead of checking consecutive rounds, so a sequence such as 0, 4, 0 incorrectly receives a convergence PASS. Because preventing false confidence is the skill's central purpose, an adversarial or ordinary nonconverged journal can obtain misleading validation and encourage premature reliance on its conclusions.
The manifest describes five stopping criteria, S1–S5, but L220–L248 introduce a mandatory exploration-output section requiring at least three discoveries and one capability-related discovery. S6 failures contribute to the overall failure count and exit status at L258–L266, so a journal satisfying the advertised criteria can still be rejected under an undeclared requirement.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(script, journal):
p = subprocess.run([sys.executable, os.path.join(HERE, script), journal],
capture_output=True, text=True, encoding='utf-8', errors='replace')
return p.returncode, (p.stdout or '') + (p.stderr or '')
uvx/uv tool run commands without ==version create a rug-pull risk.