Security audit
Security checks for vulnerabilities and agentic risk
This is a local text-file comparison skill with no network, persistence, credential access, or hidden execution, though its documentation overstates some supported document-analysis features.
Install only if you need a simple local diff tool for text files. Do not rely on the advertised Word/PDF or contract-clause analysis claims unless they are implemented later, and be careful when using -o/--output because the saved diff may include sensitive file contents.
The skill documentation invokes a Python script that reads input files and can write diff output to disk via the documented -o/--output option, but the skill metadata declares no tool scope or permissions. That mismatch can cause the skill to be granted broader file access than users expect, reducing transparency and weakening policy enforcement around file reads/writes.
The documentation claims support for Word/PDF/markdown inputs, color-coded modified lines, change summaries, and contract-clause highlighting, but the rest of the skill only describes plain-text diffs using difflib. This kind of capability inflation can mislead users and downstream agents into sending sensitive non-text documents or trusting analysis features that do not exist, creating unsafe handling expectations for legal or confidential files.
Several usage scenarios are written entirely in Chinese, including expected behavior, but the document does not say the skill is region-specific or that users may interact in other languages. Under the language/locale policy, a skill should not implicitly force a specific language without opt-in or justification.
This is a markdown file, so SQP-2 applies to user-facing descriptions of potentially impactful behavior. The option -o, --output states that diff results can be saved to a file, but there is no warning that this writes compared content to disk, which may matter for sensitive documents such as contracts mentioned elsewhere in the skill description.
No suspicious patterns detected.
