Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese-focused reply formatter that changes tone and stores limited local conversation state, with no evidence of exfiltration, deception, or destructive behavior.
Install this only if you want a Chinese-oriented, casual reply-style layer that may automatically rewrite every outgoing response. Review or disable it for formal work, safety-critical answers, multilingual conversations, or any environment where local session metadata should not be retained.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
清除状态（重置对话计数）：
rm memory/reply_state.json
# 或编辑 JSON 手动清理特定会话
The README states the skill is 'automatically applied' and 'intercepts all replies sent to users,' which gives it global influence over outbound model behavior without documenting any scope limits, opt-in, or exclusions. In a prompt/skill system, broad automatic interception increases the chance of unintended modification of sensitive, safety-critical, or system-generated responses, making policy bypasses or output corruption more likely even if the stated goal is stylistic.
The README states that language support is 'currently mainly optimized for Chinese,' while the skill auto-applies to all replies. Because no user choice, opt-in, or explicit locale restriction is provided, this can conflict with language/locale policy expectations for multilingual users.
The skill describes capabilities that read and write local state (memory/reply_state.json) but does not declare any tool scope or permission boundaries. Undeclared file access makes the skill harder to review and constrain, and can enable broader-than-expected data access or persistence if the runtime infers capabilities automatically.
The skill explicitly prioritizes Chinese behavior and says its regex and processing are optimized for Chinese without any user opt-in or negotiation. While not a classic exploit primitive, it can cause unauthorized behavior changes, degraded output quality, and policy or UX issues when applied to users expecting another language or a neutral style.
The note that the skill runs automatically before message sending is a broad trigger with no precise activation conditions, exclusions, or user opt-in. A broadly auto-invoked formatter can unexpectedly alter outputs in unrelated or sensitive contexts, including formal, safety-critical, or multilingual interactions.
The script's user-facing output is presented in Chinese, including the installation banner and error message, with no opt-in, fallback, or indication that the skill is intended only for Chinese-speaking users. This is a natural-language locale policy issue because the file enforces a specific language for interaction without user choice.
Line L110 says there is 'No support for languages other than Chinese yet,' and the surrounding examples and topic detection design are explicitly Chinese-specific. This is a natural-language policy concern because it hard-codes a language limitation without presenting user choice or a justified region-specific scope.
This code embeds Chinese greeting patterns, Chinese casual replacements, and Chinese-specific filler and punctuation rules as the default behavior for all formatted replies. That enforces a specific language/locale style without opt-in or documented scope, which matches the policy category for forced language or locale behavior.
The skill persists per-session conversation metadata to disk even though its stated purpose is only reply-style formatting. This creates unnecessary data retention and expands the attack surface: session identifiers, timing, and topic data can accumulate locally and be accessed by other components or users on the host.
The code performs local filesystem read/write operations for state management without a clear need tied to a pure formatting skill. Unnecessary file I/O can expose conversation-derived state, enable cross-session leakage, and create security/privacy issues if the runtime environment is shared or logs/backups capture the state file.
Saving session state to disk introduces persistent retention of conversation-associated data beyond the active interaction. In the context of a reply-humanization skill, that persistence is not obviously necessary, so it increases privacy risk and the chance of unintended disclosure through local access, backups, or multi-tenant environments.
}
def _save_state(self):
"""Save state to file."""
os.makedirs(os.path.dirname(self.state_file), exist_ok=True)
with open(self.state_file, 'w', encoding='utf-8') as f:
json.dump(self.state, f, ensure_ascii=False, indent=2)
This code file contains numerous user-facing strings such as scenario labels and conversation text exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale/language policy issue, and this file provides no indication that the skill is intentionally restricted to a Chinese-language context.
The value for "current_topic" is a Chinese phrase, which indicates locale-specific natural-language behavior embedded in the skill state. For all file types, locale-specific language should not be forced unless the skill offers user choice or clearly documents why a specific language is required.