Security audit
Security checks for vulnerabilities and agentic risk
This is a broad Chinese-language utility toolbox with mostly purpose-aligned features, but it needs review because it combines broad invocation phrases, file/network/system actions, and automatic local history storage of user input/output summaries.
Review before installing. Use it only if you are comfortable with a broad toolbox that can read and write user-selected files, run local diagnostics/media commands, contact third-party services for some features, and keep local history under ~/.workbuddy/dgngjx_history.json. Consider disabling or regularly clearing history and avoid using online/API modes with confidential audio, internal URLs, secrets, or sensitive documents.
The quick-reference examples use vague everyday phrases as triggers, making unintentional invocation likely during normal conversation. Because the skill includes stateful and privileged behaviors such as history logging, file operations, and networked features, accidental activation materially increases privacy and safety risk.
The activation phrases are extremely broad and overlap with normal conversational requests like '算房贷', '统计字数', or '看看CPU使用率'. In an agent setting this raises the risk of accidental tool execution, especially when combined with write, shell, and network-capable features, enabling unintended access to files, system data, or remote resources.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'.bat', '.cmd', '.ps1', '.vbs', '.exe', '.dll', '.lnk', '.msi',
'.sh', '.com', '.scr', '.hta', '.reg',
'.iso', '.dmg', '.apk', '.jar',
'.ds_store', '.env', '.log', '.tmp',
}
WARN_EXTENSIONS = {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
'.bat', '.cmd', '.ps1', '.vbs', '.exe', '.dll', '.lnk', '.msi',
'.sh', '.com', '.scr', '.hta', '.reg',
'.iso', '.dmg', '.apk', '.jar',
'.ds_store', '.env', '.log', '.tmp',
}
WARN_EXTENSIONS = {
The skill documents capabilities for file writes, shell execution, and network access, but it does not declare an explicit permission/tool scope boundary. This creates a transparency and containment problem: a host or user cannot easily determine the operational risk surface before invocation, and broad capabilities combined with vague triggers increase the chance of unintended privileged actions.
This code gathers system memory details by spawning OS-specific commands such as wmic and sysctl, which is a stronger host-inspection capability than the manifest's broad tool listing suggests. While a system-tools module exists, this specific low-level probing is presented as automatic global behavior for adaptive scheduling, not as a user-invoked system diagnostic feature.
The health check performs live outbound access to api.github.com, which is not strictly necessary to validate local installation health. Unexpected network egress can leak environment metadata, violate offline/privacy expectations, and create a larger attack surface if the endpoint or request path changes later.
The skill states that usage is automatically recorded and later summarized into weekly reports, but the privacy implication is disclosed only later in the FAQ/history sections rather than prominently at feature entry points. Silent or insufficiently disclosed logging can capture sensitive prompts, filenames, or work patterns without meaningful informed consent.
The file-level description is written entirely in Chinese and the script's user-facing strings are also Chinese-only, indicating a fixed language choice. There is no opt-in, fallback, or documented justification for restricting user-facing output to a specific language.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
def check_module(pkg_name, import_name=None):
import_name = import_name or pkg_name
try:
__import__(import_name)
return {"name": pkg_name, "status": "ok", "version": "", "required": "", "fix": None}
except ImportError:
return {"name": pkg_name, "status": "missing", "version": "", "required": "", "fix": f"pip install {pkg_name}"}
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def check_ffmpeg():
try:
r = subprocess.run(["ffmpeg", "-version"], capture_output=True, text=True, timeout=5)
if r.returncode == 0:
line = r.stdout.split("\n")[0]
return {"name": "FFmpeg", "status": "ok", "version": line[:50], "required": "", "fix": None}
The online API example reads a local audio file and sends its full contents to a user-supplied remote endpoint, but the surrounding guidance does not clearly warn that meeting recordings may contain sensitive or regulated information. In the context of meeting minutes generation, uploaded audio can include confidential business discussions, personal data, or secrets, so omission of an explicit transmission/privacy warning creates a real data-exposure risk.
该文件整体被描述为“数据换算”模块，前面的工具也都是本地计算或读取本地数据；但汇率查询实现中明确进行联网请求到第三方汇率服务。对于“汇率查询”本身联网并非不可能，但相较模块级“换算器/计算器”语义，这属于额外的远程数据获取行为，和纯本地换算的预期存在语义偏差。
This code makes an outbound request to a third-party exchange-rate API, which is a real external data transmission. While the transmitted data is limited, undisclosed or automatic network access can leak user activity patterns and violates least-surprise expectations in a calculator-style tool.
def fetch_live_rate(fr, to):
try:
url = f"https://api.exchangerate-api.com/v4/latest/{fr}"
req = urllib.request.Request(url, headers={"User-Agent": "dgngjx/4.0"})
data = json.loads(urllib.request.urlopen(req, timeout=6).read())
if "rates" in data and to in data["rates"]:
The HTTP testing snippet explicitly performs outbound network requests to arbitrary user-supplied URLs, but the surrounding documentation does not warn users that entered URLs and request metadata will be transmitted to external systems. In an agent skill context, this can lead to unintended data egress, SSRF-like misuse against internal endpoints, or unsafe testing against sensitive services if a user pastes confidential or internal URLs.
The file’s natural-language instructions and user-facing prompts are entirely in Chinese, including input/output text like “关键词” and error messages, with no indication that users may choose another language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly justified.
The file’s user-facing headings, prompts, and status messages are entirely in Chinese, including required inputs such as size and background color values. Because the skill does not offer an opt-in language choice or explain that it is intentionally limited to a Chinese-speaking or region-specific context, it violates the language/locale policy criteria.
The file presents all headings, prompts, and user-facing instructions exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not stated here.
This code reaches out to third-party joke/quote APIs over the network, which creates an external data transmission and supply-chain trust boundary. Although it appears to send no sensitive user data, it still leaks metadata such as the user's IP, user-agent, and timing, and it consumes untrusted remote content that could be manipulated or become unavailable.
def _joke_cn():
apis = [
("https://api.apiopen.top/getJoke?page=1&count=1&type=txt", lambda d: d.get("result",[{}])[0].get("content","")),
("https://v1.hitokoto.cn/?c=a", lambda d: f"{d.get('hitokoto','')} —— {d.get('from','')}")),
("https://api.oioweb.cn/api/common/Hitokoto", lambda d: f"{d.get('result',{}).get('content','')} —— {d.get('result',{}).get('from','')}")),
]
This endpoint is another unaffiliated third-party API used to retrieve remote content, introducing the same privacy and trust risks as other external calls. The danger is somewhat limited by the lack of obvious sensitive payloads, but the skill still depends on untrusted content and exposes client metadata to the service.
apis = [
("https://api.apiopen.top/getJoke?page=1&count=1&type=txt", lambda d: d.get("result",[{}])[0].get("content","")),
("https://v1.hitokoto.cn/?c=a", lambda d: f"{d.get('hitokoto','')} —— {d.get('from','')}")),
("https://api.oioweb.cn/api/common/Hitokoto", lambda d: f"{d.get('result',{}).get('content','')} —— {d.get('result',{}).get('from','')}")),
]
for url, extract in apis:
try:
The file’s headings, prompts, and user-facing instructions are entirely in Chinese, including all interactive input/output strings. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The system monitor uses subprocess execution to invoke PowerShell CIM queries and OS commands such as grep and df. While monitoring system resources is the stated function of this sub-tool, spawning shell processes is a more powerful capability than simple in-process inspection and is not clearly justified by the top-level toolbox manifest.
The history and report features persist user-provided input/output summaries to a file under the user's home directory and later surface them in generated reports. This creates a real privacy and data-minimization risk because potentially sensitive prompts, results, filenames, or work content may be retained beyond the immediate task without prominent consent, retention disclosure, or sanitization.
The history logger stores user input and output summaries with timestamps in a persistent JSON file, yet the markdown description does not provide a clear privacy warning or explicit consent flow. Users may unknowingly save sensitive business content, credentials, or personal information that can later be read locally or surfaced by related features.
The history and reporting workflow stores and later re-displays natural-language summaries of user inputs and outputs, which can contain secrets, personal data, proprietary text, or operational details. Because the data is kept on disk and then re-presented in reports, the feature expands exposure duration and audience, increasing the chance of accidental disclosure.
No suspicious patterns detected.