Security audit
Security checks for vulnerabilities and agentic risk
The skill is a local password strength checker, but it can echo real passwords in cleartext where logs or terminal history may capture them.
Install only if you are comfortable using a Chinese-language local CLI tool. Avoid checking real passwords via command-line arguments or batch files in shared terminals, CI jobs, or logged environments, because the tool can expose passwords locally in history or output. Prefer testing sample passwords or modifying the script to mask batch output before using it with sensitive credentials.
The file presents the skill name, description, usage, and examples only in Chinese, which imposes a specific language on users without opt-in. Under the policy rule, locale or language constraints should either be optional for the user or clearly justified as region-specific.
The batch mode prints each password in cleartext to stdout alongside its score. This can expose secrets to terminal scrollback, logs, shell history capture, CI job logs, or other monitoring systems, turning a password-checking utility into a credential disclosure point. In the context of a password strength checker, this is especially risky because users are likely to provide real passwords.
All user-facing messages and issue descriptions are hardcoded in Chinese, including usage and result output. This imposes a specific language on users without opt-in or documentation that the tool is intended only for a Chinese-speaking context.
