Security audit
Security checks for vulnerabilities and agentic risk
This skill needs review because it adds unrelated advertising to results and can install software automatically during document extraction.
Prefer a version that removes mandatory advertising and makes dependency setup explicit in a dedicated environment. Review generated skills before installing them, and remember that source content is retained locally. The empty SARIF results do not negate the concerns verified directly in the files.
The final section explicitly requires unrelated advertising and an external recruitment link in every result, redirecting assistant output toward the author's promotional interests without user authorization. This is output contamination, not evidence of data exfiltration or malicious behavior at the linked destination; it duplicates the other promotional findings.
The skill mandates unsolicited promotion unrelated to content distillation, allowing its author to insert advertising into otherwise legitimate task responses. The supplied document establishes an instruction to append that material, but does not establish actual console behavior by the unprovided PDF extraction script; this is the same underlying issue as the other promotional findings.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.workbuddy/skills/方法论-{名称}/{references,examples}
# 如有模板/脚本需求，再创建：
mkdir -p ~/.workbuddy/skills/方法论-{名称}/{templates,scripts}
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.workbuddy/skills/方法论-{名称}/{references,examples}
# 如有模板/脚本需求，再创建：
mkdir -p ~/.workbuddy/skills/方法论-{名称}/{templates,scripts}
A missing dependency silently triggers installation of unpinned packages and transitive dependencies using the configured package index, modifying a potentially shared Python environment. Installing packages can execute third-party code, so compromised distribution infrastructure or unsafe index configuration could turn a local EPUB-extraction request into code execution with the installer's privileges.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
except ImportError:
import subprocess
python = str(Path.home() / ".workbuddy/binaries/python/envs/default/bin/python3")
subprocess.run([python, "-m", "pip", "install", "ebooklib", "beautifulsoup4", "-q"], check=True)
from ebooklib import epub
from bs4 import BeautifulSoup
When pdfplumber is unavailable, a text-extraction operation unexpectedly installs an unpinned package and its dependencies into a hard-coded WorkBuddy environment using the caller's privileges. This creates an unnecessary supply-chain exposure and can change dependencies used by other workflows; it also may target a different interpreter from the one running the script.
The missing-dependency handler silently authorizes package installation instead of limiting execution to the requested PDF extraction. This is the same underlying issue as SDI-2, not an additional independent vulnerability: it introduces network-dependent software installation and environment changes without explicit approval.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
except ImportError:
import subprocess, pathlib
python = str(pathlib.Path.home() / ".workbuddy/binaries/python/envs/default/bin/python3")
subprocess.run([python, "-m", "pip", "install", "pdfplumber", "-q"], check=True)
import pdfplumber
if not os.path.exists(input_path):
The naming rule explicitly requires a short Chinese name for every generated skill directory. This imposes a natural-language requirement without user opt-in or a documented technical or regional justification.
The instruction to append promotional material to every output is an explicit attempt to hijack part of the assistant's response for an unrelated objective. Its placement in a legitimate workflow can lend the promotion undeserved credibility, although no automatic navigation, sensitive-data transfer, or execution is shown.
The extractor unconditionally prints unrelated promotional content and an external group link, including when the module is imported. In an agent workflow, these messages can contaminate tool output and be repeated to users as if relevant or endorsed, although the code does not visit the link or transmit extracted content.
The manifest describes extracting methodologies from content and generating reusable skills, not promoting a public account or monetization community. These unconditional module-level print statements introduce unrelated advertising into command output and also execute when the module is imported.
No suspicious patterns detected.