Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed web-research and knowledge-base intake workflow with sensitive actions gated by user confirmation.
Install only if you want an agent to help search the web and organize findings into a local or cloud knowledge base. Review confirmations carefully before any archive, cloud upload, browser automation, deletion, migration, or persistent rule change, and prefer the local Obsidian path for sensitive research.
Referenced artifact was not completely inspected
Read `references/platform-adapters.md` and only the selected platform's operation file. Do not load all platform files by default.
Referenced artifact was not completely inspected
Read `references/platform-adapters.md` and only the selected platform's operation file. Do not load all platform files by default.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Path Safety / 路径安全
All local write paths must be inside either the canonical config directory or a user-confirmed Obsidian vault path.
Use resolved path containment checks, not string prefix checks:
The description lists trigger examples such as "帮我查一下", "verify this claim", and "整理搜索结果", alongside a very wide "Use when" clause covering many common research-related requests. Although some examples are specific, others are generic enough that they could match everyday requests without clearly distinguishing when this skill should activate versus when another skill should handle the task.
The skill enables implicit invocation with no visible activation constraints, so the agent may trigger web-research behavior in situations broader than the user intended. Because this skill can search, verify, stage, archive, and move research into knowledge bases, over-broad activation increases the chance of unintended external browsing, source processing, or persistence of unreviewed content.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
5. Open relevant sources and classify claim evidence.
6. Stage trusted/allowed and review results without treating domain trust as claim truth.
7. Ask the user to approve rule changes, archive targets, or cloud writes.
8. Write confirmed changes and append audit logs only after operations succeed.
Report template:
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
When multiple useful results share a domain, propose but do not apply a persistent rule automatically. The proposal concerns future source handling, not truth of every claim:
Rule suggestion
Skill injects content designed to persist in agent memory or context across interactions. Persistent injection can alter agent behavior long after the initial interaction.
Domain: example.com Reason: 6 previously reviewed items from this domain Proposed action: mark domain allowed for this topic Options: apply for this run only, create a scoped persistent rule, keep reviewing one by one
## Cleanup dry-run
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
4. Copy only confirmed non-secret fields.
5. Ask before creating or writing the v4 config.
6. Do not modify or delete legacy data automatically.
7. Append a `config_migration` audit record only after the write succeeds.
## Dry-Run Report
SQP-3 applies to all file types and covers language or locale policy violations. The title and document structure force mixed Chinese and English presentation throughout, but do not offer the user a language preference or explain that the skill is intended for a bilingual audience.
No suspicious patterns detected.