Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward progress-reporting helper that writes local report files and can use timers, with no evidence of deception, exfiltration, or destructive behavior.
Install this if you want Chinese-language periodic progress reports for long-running tasks. Before enabling it, confirm the report interval, whether a timer should run, and whether the local report files may include sensitive task details; delete or archive the reports when they are no longer needed.
The skill directs the agent to create directories and write persistent report files, but it declares no tool scope or permissions boundary. That mismatch can cause the agent to perform file-write actions without explicit least-privilege controls, increasing the chance of unintended filesystem modification or abuse if the skill is triggered unexpectedly.
The trigger phrases are broad enough to match ordinary requests about status updates, which can activate the skill when the user did not intend to enable periodic reporting or file persistence. In this skill, accidental activation is more dangerous because it may start background reporting behavior and write reports to disk automatically.
The activation description and operational guidance are written to produce progress reporting behavior in Chinese, but the file does not state that language is optional or user-selectable. This can violate a language/locale policy if the skill assumes Chinese output regardless of user preference.
The skill instructs persistent storage of detailed progress reports to a fixed path without warning the user that task details, timing, issues, and resource data will be written to disk. This can expose sensitive operational data, user content, or environment details through retained local artifacts, especially for long-running training, crawling, or batch-processing tasks.
This code includes natural-language descriptions and user-facing messages exclusively in Chinese, starting with the module docstring and continuing throughout the CLI help and printed report content. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
No suspicious patterns detected.
