Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a document-generation helper, but it tells the agent to run a relative local script that is not included in the package and to create files in the workspace.
Review before installing. The document-generation behavior is understandable, but the package should either include the referenced builder script or remove the command instruction; otherwise an agent may fail or resolve `scripts/build_report.py` from an unintended workspace location. Users should also confirm where `./out` points and whether same-day report files may be overwritten.
The natural-language description includes '中文文档', which indicates the skill is intended to produce Chinese-language documents. Because the file does not offer users a language/locale choice or explain a necessary region-specific restriction, this is a language-policy violation under the stated rules.
The skill explicitly instructs the agent to invoke scripts/build_report.py and write .md and .txt files into ./out, but it does not warn the user that local files will be created or potentially overwritten. This can lead to unintended filesystem side effects, especially in shared workspaces or automation contexts where users may not realize the skill performs persistent writes.
