Security audit
Security checks for vulnerabilities and agentic risk
This is a local, offline cat-sticker matching skill with some noisy defaults and minor disclosure issues, but no evidence of exfiltration, privilege escalation, destructive behavior, or hidden execution.
Install only if you want a Chinese-language chat sticker helper that can automatically react to ordinary messages. Review the packaged defaults before use because probability is set to 1.0 and cooldown to 0, and be aware that successful matches return a local absolute sticker path to the caller.
The declared purpose understates several behaviors: persistent state mutation, absolute path exposure, and additional commands beyond the summarized description. This mismatch can mislead reviewers and users about what data is stored or exposed, increasing the chance of unsafe deployment; returning absolute paths can also leak local filesystem layout information.
The skill explicitly documents persistent reads/writes to sticker_config.json and sticker_cooldown.json, but it declares no permission scope or allowed-tool boundaries. In environments that rely on manifest-declared capabilities for isolation or user consent, this creates an undeclared file-access surface and weakens policy enforcement.
The manifest description is entirely in Chinese and presents the skill as a Chinese-language system without indicating that other languages are supported or that the user can choose a locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The activation and control commands such as “表情开关”, “表情概率”, and “表情帮助” are specified only in Chinese, and the document does not provide alternate-language commands or an opt-in language setting. This can amount to a locale policy violation because the skill effectively requires a specific language for operation.
The module docstring and examples are primarily written in Chinese, and the stated usage examples assume Chinese input. For a general-purpose skill, this presents a natural-language locale constraint without documenting user choice or limiting the skill to a justified region-specific context.
The function contract says it will not expose absolute paths, but the returned object includes sticker_path = str(STICKERS_DIR / fname), which reveals the host filesystem layout to callers. In an agent/plugin environment, leaking absolute paths can disclose usernames, workspace structure, mount points, or deployment details that help an attacker target subsequent file-access or environment-specific attacks.
The parser only recognizes Chinese commands such as '表情开关', '表情概率', and '表情帮助', and all responses are returned in Chinese. This enforces a specific language in the user-facing interface without offering an alternative or documenting a justified locale restriction.
The trigger set includes many extremely common tokens such as "？", "什么", "怎么", "想", "嗯", "好", "行", and "吃", which are likely to appear in ordinary conversation unrelated to stickers. In a skill that automatically reacts to user text, this can cause unintended activations, noisy behavior, and manipulation of conversation flow, especially with probability 1.0 and cooldown_rounds 0 making triggering effectively always-on.
L259 写明“用该情绪得分除以最高分情绪得分”，若“该情绪”就是已选中的最高分情绪，则结果恒为 1，这与前文示例返回值中的 0.85 及通常置信度含义相矛盾。这属于文档对实现意图的主动误述，而不是单纯遗漏细节。
清单描述重点是分析文本情绪并从 custom_stickers.json 匹配表情，支持概率/开关/冷却调节指令；但实现不仅读取表情库，还会在 L92-L97、L122-L127 持久化写入 sticker_config.json 和 sticker_cooldown.json。虽然这些写入与功能相关，但它们超出了“从 JSON 自动匹配表情”的核心表述，属于描述未体现的状态修改行为。
This JSON manifest contains user-facing natural-language descriptions that are overwhelmingly in Chinese, with no indication that the skill is region-specific or that users can choose their preferred language. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern even in data/config files.
The trigger configuration is predominantly tied to Chinese-language terms and expressions, which implies language-specific behavior. There is no visible indication here that users can choose the language/locale or that the restriction is intentionally documented as region-specific.
