Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a legitimate course-design skill, but it needs review because its Word export script can write to arbitrary local paths and its web/URL access is under-disclosed.
Review this skill before installing if it will run with broad filesystem access. It should ideally constrain exports to a dedicated workspace directory, require confirmation before visiting external links or creating files, and treat all uploaded documents and web pages as untrusted input.
The declared purpose presents the skill as a course-design assistant, but the content also instructs the system to generate and save Word documents, read structured data from files/JSON/stdin, and return file metadata. This mismatch hides materially different capabilities from users and reviewers, undermining informed consent and enabling unexpected file-system interactions.
The skill references local files and a document-generation script, implying file-read and file-write behavior, but it declares no explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where a host agent may grant broader filesystem access than users expect, increasing the risk of unintended data exposure or misuse.
技能名称、描述及全文指令均默认并固定为中文使用场景，且 TRACE 中还特别声明“支持中文交互”，但没有向用户提供语言/locale 选择或说明仅适用于特定中文区域合规场景。若组织要求语言可选或不得强制固定语言，这种默认单一语言设定可能构成自然语言政策问题。
L015 将触发条件描述为“用户需要设计培训项目方案、课程设计方案或人才发展计划”，这是高层级需求描述而非明确触发短语或限定场景，边界不足。文档未提供负例、排除条件或更具体的调用约束，容易导致在泛化的培训咨询语境中被意外触发。
The skill instructs the agent to access user-provided URLs and analyze their contents without warning about privacy, untrusted external content, or potential data leakage. Following arbitrary links can expose the system to malicious pages, tracking, sensitive tokenized URLs, or inadvertent transmission of user context to third parties.
The TRACE section claims there is 'no external dependency risk,' yet the skill explicitly requires visiting user-provided URLs and performing industry trend searches. Misrepresenting network exposure can cause reviewers and users to underestimate privacy, tracking, malicious-link, and data-exfiltration risks associated with external access.
The skill file is entirely framed in Chinese starting from the title, with no indication that users may choose another language or that the locale restriction is necessary for a region-specific purpose. This creates a natural-language policy concern because it effectively forces a specific language without documented opt-in.
The script accepts a user-supplied output path and writes the generated .docx there after converting it to an absolute path, without restricting the destination to a safe workspace directory or validating allowed filenames. In an agent or skill environment, this broader file-write capability can be abused to overwrite arbitrary files accessible to the process, which exceeds the minimum capability needed for course document generation.
The skill includes Word document generation that creates or writes files, but it does not clearly inform the user at the time of execution that a file will be created and stored. This can lead to unexpected persistence of potentially sensitive course content or uploaded material in the local environment.
