Security audit
Security checks for vulnerabilities and agentic risk
This skill performs a disclosed local-only DOCX structure preflight and advisory review-package check without network access or document modification.
Install only if a Chinese-language, local DOCX preflight and advisory review workflow fits your use case. The skill still needs access to the DOCX and review JSON files you point it at, but the inspected artifacts do not upload data, modify DOCX files, or create lasting background behavior.
The file contains user-facing error text in Chinese, such as the argument validation message at L12. Because the CLI consistently presents messages in a single language with no opt-in, fallback, or documented regional limitation, it creates a natural-language locale policy issue under the rule for forced language selection.
Multiple externally visible messages, including failure responses and input/readability errors, are all written in Chinese across these lines. This indicates the skill enforces a single language for interaction rather than offering user choice or clearly documenting a justified locale restriction.
This code contains numerous natural-language messages and boundary descriptions exclusively in Chinese, including thrown error text and returned status text. Under the policy, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.
The self-check constructs a sample document containing Chinese text literals such as '合成教材' and '项目简述'. This bakes in a specific language/locale choice in natural-language content without any opt-in or explanation that the skill is intentionally Chinese-specific.
This script creates a temporary directory, writes multiple files into it, and then removes that directory recursively in the finally block. Although this is test/self-check behavior, the file itself provides no confirmation prompt, log message, or inline warning before performing file-system writes and deletion.
Detected: suspicious.dangerous_exec
