Security audit
Security checks for vulnerabilities and agentic risk
This skill runs a local Python helper to read user-provided SQL files and write index recommendations, with no evidence of hidden network access, persistence, or destructive behavior.
Install only if you are comfortable giving the agent local paths to schema and slow-query files. Use non-sensitive copies when possible, and choose an output path that is safe to create or overwrite. Review the generated index DDL with a DBA or execution-plan tooling before using it in production.
The skill instructs use of a Python script that reads user-supplied input files and writes output files, but the manifest declares no explicit tool scope or permissions. This creates an avoidable trust gap: an agent may be allowed broader file access than the skill actually needs, increasing the chance of unintended file reads/writes or abuse if the skill is invoked with sensitive paths.
The manifest description and the main heading/content are written in Chinese, which imposes a specific language presentation on users without any opt-in or stated regional constraint. Under the policy rule, language-specific behavior should either be optional or clearly justified as region-specific.
No suspicious patterns detected.
