Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward JokeAPI helper that makes user-initiated requests to an external joke service and does not show hidden persistence, credential access, or remote code execution.
Install only if you are comfortable with user-invoked requests being sent to JokeAPI, including any text passed with --contains. Use --safe-mode or blacklist flags when jokes may be shown in work or public contexts.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 获取笑话
local response
response=$(curl -s "$url")
# 根据格式输出
if [[ "$FORMAT" == "txt" ]]; then
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 列出分类
list_categories() {
curl -s "${BASE_URL}/categories" | python3 -c "
import sys, json
data = json.load(sys.stdin)
print('可用分类:')
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 列出语言
list_languages() {
curl -s "${BASE_URL}/languages" | python3 -c "
import sys, json
data = json.load(sys.stdin)
print('支持的编程语言:')
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# 获取 API 信息
get_info() {
curl -s "${BASE_URL}/info" | python3 -m json.tool
}
# 解析命令行参数
The file's user-facing instructions and descriptions are presented only in Chinese, which effectively forces a specific language for use of the skill. The policy allows language constraints only when users are offered a choice or when the locale restriction is clearly documented and justified, neither of which appears here.
This code file contains natural-language strings that present usage, help text, and runtime messages in Chinese only. Under the policy, a skill should not force a specific language or locale unless it offers user opt-in or clearly documents a justified regional constraint, which is not present here.
The script sends user-provided search text from --contains to a third-party API over the network without any explicit notice, consent prompt, or local-only alternative. While this is expected for an API client, it still creates a real privacy risk because arbitrary user text may contain sensitive data and is transmitted off-host to an external service.
The skill documentation is written entirely in Chinese, including usage instructions and warnings, with no indication that the skill is intended only for a Chinese-speaking audience or that other language options are available. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The natural-language configuration sets LANG="en" as the default, which forces a specific language unless the user discovers and overrides --lang. Under the policy, locale or language constraints should be optional, user-selected, or clearly justified.
No suspicious patterns detected.