Security audit
Security checks for vulnerabilities and agentic risk
This skill provides a controlled note-drafting workflow, but its checks cannot reliably guarantee exact quotations or complete disclosure of missing information.
Use local files for confidential material unless you approve the optional parser's data handling. Check quotations and missing-information statements yourself even after a passing result. Choose a new output filename to avoid overwriting an existing note, and review or pin installer content. This assessment covers the bundled files, not future downloads or the separate parsing service.
核心差异是交付物的完成程度：描述承诺带可回查要点的成品笔记，而代码明确只负责骨架，生成后仍需补写要点和有效来源锚。这是主要行为上的实质差异，不只是实现细节。本地读取、离线运行、引用摘录和来源登记与描述一致；URL 仅作登记也符合正文预先取回本地的约定。所提供代码未包含或调用 check_note.py，但仅凭这一代码片段不能断定整个技能没有该检查器。未见网络访问、外传或其他无关能力。
Referenced artifact was not completely inspected
bash scripts/fixtures/run_fixtures.sh # 离线三档一次跑完，末行自报档数与不合枚数
The installation command executes an unpinned npm CLI through npx and installs skill content from an unpinned repository reference. Although this is an installer rather than an MCP server declaration, mutable dependencies create a supply-chain exposure if a later release or repository revision is compromised; the offline checker does not protect the installation step.
The documented npx command runs an unpinned npm CLI and retrieves skill content without an immutable repository revision. The finding mislabels this as an MCP server reference, but the underlying supply-chain risk remains: compromised future content could execute locally or introduce malicious agent instructions.
Without declared permissions the skill's intent is opaque and cannot be validated.
The default URL route delegates parsing to an external service without explicitly warning that the supplied URL is disclosed to that provider. URLs may contain signed access tokens, private document identifiers, or sensitive query parameters; asking about usage costs does not establish informed consent to that disclosure.
The checker removes all whitespace from both the quote and source before comparison, so it can certify altered wording as verbatim. Whitespace can change token boundaries, numbers, or code meaning, making this an integrity bypass of a central provenance guarantee rather than merely a cosmetic normalization.
The coverage predicate accepts any section-three bullet containing a gap keyword as evidence for every gap mentioned elsewhere. Consequently, one unrelated or generic declaration can hide omitted limitations while the checker reports success, undermining the skill's advertised per-gap provenance check.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
p = Path(a.out)
try:
p.parent.mkdir(parents=True, exist_ok=True)
p.write_text(body, encoding='utf-8')
except OSError as e:
print('取值域故障：写不到 %s（%s）' % (p, e.strerror or '原因未取到'))
return 3