Security audit
Security checks for vulnerabilities and agentic risk
The skill is a mostly disclosed local data-delivery toolkit, but its deployment helper can stop and start services and contains a shell fallback that contradicts its shell-free safety claim.
Review before installing in sensitive environments. Use it in a project sandbox, only point endpoint-based tools at services you are authorized to test, and do not run rebuild.py unless you are comfortable with it stopping a service by port and starting a detached process. Redact sensitive prompts, SQL, reasoning, and reports before sharing outputs. The shell fallback and full environment inheritance should be fixed or operationally controlled.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Calling remote QA engines over HTTP and producing gate-like regression results extends the skill from static semantic work into active networked evaluation and decision support. This is risky because prompts, model metadata, or business-sensitive test cases may be transmitted externally, and the outputs may be treated as authoritative despite being generated by an undeclared remote interaction path.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def run(script, *args):
command = [sys.executable, str(SCRIPTS / script), *map(str, args)]
result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8",
env=dict(os.environ, PYTHONIOENCODING="utf-8"))
if result.returncode:
raise RuntimeError(f"{script}: {result.stdout}\n{result.stderr}")
print("PASS " + script)
The file contains an explicit security assurance that commands are executed with shell-free argument arrays, but the actual code later uses sh -c. This mismatch is dangerous because it can cause reviewers and operators to underestimate risk and deploy the tool in sensitive CI/CD or service-management workflows, where even a small shell-execution foothold can have outsized consequences.
The child process inherits the full parent environment via dict(os.environ, PYTHONIOENCODING="utf-8"). In CI/CD or release-gate contexts, environment variables often contain secrets, tokens, proxy settings, or Python startup controls; passing them wholesale to subsidiary scripts expands the trust boundary and can expose sensitive values to less-trusted code or alter execution through inherited variables.
def run_gate(name, command):
result = subprocess.run([sys.executable, str(HERE / command[0]), *command[1:]],
capture_output=True, text=True, encoding="utf-8", errors="replace",
env=dict(os.environ, PYTHONIOENCODING="utf-8"))
return {"gate": name, "status": "pass" if result.returncode == 0 else "fail",
"detail": "\n".join((result.stdout + result.stderr).splitlines()[-5:])}
The skill advertises capabilities and workflows that imply file, shell, environment, and possible network access, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization ambiguity where an agent runtime may permit broader actions than the user expects, increasing the chance of unintended file modification, command execution, or data exposure.
The primary description is written entirely in Chinese and presents the skill's behavior and scope in that language, with no indication that other languages are supported or that the user may choose their preferred locale. Under the policy, language constraints should be optional or clearly justified; this file does not provide such an opt-in or justification.
Multiple values and labels in this manifest are written in Chinese, which imposes a specific language on users or downstream consumers. The file does not indicate that the skill is China-specific, nor does it offer any language/locale opt-in or alternative.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(script, *args):
command = [sys.executable, str(SCRIPTS / script), *map(str, args)]
result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8",
env=dict(os.environ, PYTHONIOENCODING="utf-8"))
if result.returncode:
raise RuntimeError(f"{script}: {result.stdout}\n{result.stderr}")
The entire skill description is written in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
This Python file contains natural-language instructions and descriptions entirely in Chinese, and the script also emits Chinese-only output. Under the language/locale policy rule, forcing a specific language without user opt-in is a policy violation unless the locale restriction is explicitly justified, which is not stated here.
SQP-3 applies to all file types, including JSON. The repeated natural-language prompts and labels are exclusively in Chinese, but the file does not document that the skill is China/Chinese-specific or that users can opt into the locale, which can violate language/locale policy requirements.
This code includes natural-language instructions and descriptions entirely in Chinese, which imposes a specific language on users without any opt-in or documented justification. The stated policy flags language or locale constraints unless the skill offers a choice or clearly documents a justified regional scope.
This manifest uses Chinese-only natural-language values for the domain, field labels, instructions, concepts, metrics, and ontology text. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
The module docstring is written entirely in Chinese and does not offer any language choice or indicate that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
This JSON file encodes all user-facing question examples and labels exclusively in Chinese, indicating a fixed language/locale assumption. The policy requires flagging language constraints when the skill does not offer user choice or document a justified region-specific limitation.
The manifest sets the domain and downstream semantic definitions in Chinese, and the AI instructions are also written only in Chinese. There is no natural-language indication that the locale is optional, user-selected, or justified as a region-specific tool, which can violate language/locale policy requirements.
The module docstring presents the skill entirely in Chinese and frames the dataset semantics using Chinese labels, with no indication that language choice is optional. Under the policy, locale-specific behavior should be opt-in or clearly justified as region-specific; this file does not state such a constraint explicitly.
Detected: suspicious.dynamic_code_execution