Security audit
Security checks for vulnerabilities and agentic risk
This is a local file-writing tool, but its spreadsheet append mode can destroy existing data and its naming/docs can mislead users about encryption and format support.
Install only if you need a simple local writer and can tolerate its limitations. Do not assume it encrypts files. Back up important files before using overwrite or append, avoid XLSX append on existing workbooks, and do not append to untrusted DOCX files.
write_file.py:367XLSX Append Operation Silently Overwrites Existing Spreadsheet Data
write_file.py:231Unbounded DOCX Archive Decompression Enables Memory Exhaustion
The skill’s branding and documentation materially overstate its security and format capabilities: the name suggests encryption, the description suggests enterprise-security robustness, and the text claims 80+ supported formats, while the documented behavior only truly handles text-like files plus limited .docx/.xlsx generation. This mismatch can cause operators or downstream agents to trust the tool for secure handling of sensitive files or format-correct writes when it does not actually provide encryption or broad format-aware protections, leading to misuse and accidental exposure or corruption.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
|------|--------|----------|
| **文本类** | .txt, .md, .markdown, .rst, .log, .csv, .tsv | UTF-8 文本写入 |
| **代码类** | .java, .py, .js, .ts, .jsx, .tsx, .c, .cpp, .h, .cs, .go, .rs, .rb, .php, .vue | UTF-8 文本写入 |
| **配置类** | .json, .xml, .yaml, .yml, .toml, .ini, .cfg, .properties, .gradle, .config, .env | UTF-8 文本写入 |
| **样式类** | .html, .htm, .css, .scss, .sass, .less | UTF-8 文本写入 |
| **脚本类** | .sh, .bash, .bat, .cmd, .ps1, .sql | UTF-8 文本写入 |
| **Office** | .docx (Word), .xlsx (Excel) | OpenXML ZIP 格式写入 |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'.sql', '.graphql', '.gql',
# 配置文件
'.config', '.env', '.env.example', '.env.local', '.env.production',
'.htaccess', '.editorconfig', '.gitignore', '.gitattributes', '.gitmodules',
'.dockerfile', '.dockerignore',
'.makefile', '.mk', '.cmake',
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'.sql', '.graphql', '.gql',
# 配置文件
'.config', '.env', '.env.example', '.env.local', '.env.production',
'.htaccess', '.editorconfig', '.gitignore', '.gitattributes', '.gitmodules',
'.dockerfile', '.dockerignore',
'.makefile', '.mk', '.cmake',
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'.sql', '.graphql', '.gql',
# 配置文件
'.config', '.env', '.env.example', '.env.local', '.env.production',
'.htaccess', '.editorconfig', '.gitignore', '.gitattributes', '.gitmodules',
'.dockerfile', '.dockerignore',
'.makefile', '.mk', '.cmake',
This markdown file contains user-facing natural-language content exclusively in Chinese, including headings, descriptions, and remediation notes. Under the policy rule for language/locale violations, forcing a specific language without user opt-in or a documented justification is a finding.
The README documents overwrite-by-default behavior and automatic directory creation without prominently warning about destructive outcomes. In a file-writing skill, this increases the risk of accidental data loss or unintended modification of local files, especially when invoked by an agent or with user-supplied paths.
The manifest description says the skill supports text, Word (.docx), Excel (.xlsx), and 80+ formats. However, the README explicitly says direct writing to .docx/.xlsx is not supported without extra dependencies, and the documented usage is a CLI text file writer using encodings rather than a true multi-format document writer. This is a clear mismatch between claimed scope and described behavior.
The manifest description and nearly all user-facing instructions are presented exclusively in Chinese, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language locale violation unless the constraint is clearly justified as region-specific.
The metadata is internally inconsistent: the skill name/description still present it as an 'encrypted' file writer while the changelog claims that misleading encryption language was removed. In a security-sensitive enterprise context, this can mislead users into believing written files are protected by encryption when they may only be encoded or formatted, causing inappropriate handling of sensitive data.
The description text is entirely in Chinese, which indicates a language-specific skill presentation without offering a user language choice or explaining that the skill is intended only for a Chinese-speaking or region-specific context. This matches the policy concern for natural-language locale constraints that are not opt-in or clearly justified.
This Python file contains natural-language documentation entirely in Chinese, including the tool name, usage, and warnings, and the CLI help/output strings are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which it is not here.
The skill is named 'encrypted-file-writer' in the manifest, and the README title presents it as an enterprise file writer, but the documentation then explicitly states '本工具不是加密工具'. This creates an intent-level contradiction between the apparent skill identity and the documented behavior, which could mislead users about security properties.
Natural-language policy violations include forcing a specific language or locale without user opt-in. This README presents all operational guidance in Chinese and does not indicate that users can choose another language or that the locale restriction is required for a region-specific purpose.