Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese writing and document-checking skill with local read-only checking scripts; the main cautions are broad triggers and a skill-local learning ledger.
Install this if you want a Chinese-focused writing and document-review workflow. Be aware that it may process supplied documents through local checker scripts, may ask to verify time-sensitive facts online, and may keep skill-local learning notes if your agent follows that section. Review before enabling optional git hooks or allowing the agent to edit the installed skill files.
声明描述的是中文写作技能，重点在文档撰写、润色、体检、文章去AI味和人性化改写等内容生产/编辑能力。实际代码并不进行写作、改写、润色、风格调整或文档质量体检，而是做改前改后文本的差异审计，尤其用于发现未申报修改和数字变动。这与“核对文档”有部分边缘相关，但代码的主要目的明显是修订对账与变更审计，而非声明中的写作技能本体。因此存在实质性描述-行为不匹配。
声明描述的是一个广义中文写作与文档优化技能，包含写文档、改文档、文档体检、文章改写、去AI味等编辑类能力。代码却是一个非常具体的“文档数字对账器”，核心功能是解析文本/Markdown 表格并校验数字计算是否正确。虽然声明中提到“数字可对账”和“文档体检”，与代码的数字核验方向存在部分相关性，但代码并不实现写作、润色、改写、结构优化、标题/长句/锯末词检查、文章模式等声明中的主要能力。其实际主功能明显更窄，且偏向独立的算术检查命令行工具，因此描述未能准确代表该代码块的实际行为，属于实质性不匹配。
This markdown changelog states that the description now includes the /deai trigger word and that prior boundaries were removed, but it does not explain when the trigger should or should not activate. Because /deai is short and the entry provides no negative examples or context limits, the activation scope is ambiguous in this file.
The changelog notes that English support is only covered by a boundary statement and separate thresholds are not implemented yet, implying the skill behavior is constrained by language. This suggests a locale/language limitation without indicating user choice or opt-in, which can violate language policy requirements.
The skill advertises very broad trigger phrases such as '写文档/改文档/文档润色/汇报材料/去AI味', which overlap with many ordinary user requests and can cause the skill to activate outside a narrowly intended scope. In an agent environment, overly broad auto-triggering increases the chance that unrelated content is routed through this skill, potentially causing inappropriate transformations, unintended data handling, or policy bypass through skill selection ambiguity.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
├── .gitignore
├── .learnings/ # 自进化台账模板（LEARNINGS/ERRORS/FEATURE_REQUESTS）
├── references/
│ ├── write-flow.md # WRITE 操作卡 + 七种文档原型 + 进度卡模板
│ ├── style-rules.md # 句法纪律完整表 + 放行项判定流程
│ ├── deai-flavor.md # 锯末词表 + G1-G5 + P1-P3 + 自检清单
│ ├── article-mode.md # 文章模式：六类诊断 + 改写 + 输出格式（原 deai-skill）
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
├── .gitignore
├── .learnings/ # 自进化台账模板(LEARNINGS/ERRORS/FEATURE_REQUESTS)
├── references/
│ ├── write-flow.md # WRITE 操作卡 + 七种文档原型 + 进度卡模板
│ ├── style-rules.md # 句法纪律完整表 + 放行项判定流程
│ ├── deai-flavor.md # 锯末词表 + G1-G5 + P1-P3 + 自检清单
│ ├── article-mode.md # 文章模式:六类诊断 + 改写 + 输出格式(原 deai-skill)
The README states that the skill auto-triggers on broad intents like '写文档/改文档/去AI味/文档体检' without clear scoping rules or exclusions. This ambiguity makes skill invocation unpredictable and can let the skill intercept common requests that should instead be handled by a safer or more specialized path, increasing the risk of unintended processing of sensitive user material.
The trigger list includes broad everyday phrases such as '写文档', '改文档', and '润色文章', which can cause accidental invocation in unrelated conversations. Unintended activation can expose user content to a different instruction set than expected, increasing the chance of unwanted transformations, extra processing, or policy conflicts in multi-skill environments.
The file states “适用范围：中文文档与中文文章。句长阈值按中文字符设计，英文不适用,” which imposes a language constraint in the skill instructions. Because this is framed as a hard limitation rather than a user-selectable preference or documented regional compliance need, it is a natural-language locale policy concern.
The metadata strongly presents the skill as Chinese-only ('中文写作', Chinese trigger phrases, Chinese description) without any indication that language behavior is user-selectable. This can override user expectations or route content into a language the user did not request, which is a policy and usability risk rather than a code-execution issue.
The file is entirely scoped as a Chinese-writing mode and explicitly directs users to use this mode for Chinese article finalization, while also referring to a separate Chinese humanizer workflow. This imposes a language-specific mode by default without offering a user choice or opt-in within the file itself.
The entire instruction set is written as prescriptive Chinese-only guidance, including required labels and output phrases such as '已核实', '待核实', and the mandated delivery format. There is no indication that the user may choose another language or locale, so the file imposes a language constraint without opt-in.
The entire skill guidance is written only in Chinese and presents the terminology mechanism as a universal documentation process, with no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is in scope.
The skill content is entirely written in Chinese and provides Chinese-only writing workflows, without indicating any fallback or user language choice. This can cause exclusion, misunderstanding, or unsafe use when a user expects another language, though it is not a classic security exploit and appears to be a product-safety/accessibility issue rather than malicious behavior.
The file’s user-facing documentation and CLI descriptions are entirely in Chinese, which effectively constrains use to a single language without indicating any user choice or opt-in. Under the policy rule, language-only instructions can be a natural-language policy violation when no alternative or selection mechanism is offered.
This Python file contains natural-language docstrings, CLI descriptions, and output messages entirely in Chinese, including the module description and command help text. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
The module docstring, CLI description, help text, and output strings are all exclusively in Chinese, which imposes a specific language on users. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-only audience or region-specific workflow.
The module docstring presents the tool entirely in Chinese and frames it as a Chinese sentence scanner, and the user-facing CLI text throughout the file is also exclusively Chinese. This imposes a specific language/locale on users without offering opt-in, fallback, or documenting a justified region-specific constraint.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
The skill is explicitly designed as a Chinese writing skill and its examples, triggers, and workflows are all Chinese-only, with no indication that the agent should detect or respect the user's preferred language. This can cause unexpected language switching, reduce usability, and increase the chance of misunderstanding in mixed-language or accessibility-sensitive contexts, though it is not a direct security exploit.
This markdown skill file presents all instructions and examples only in Chinese, which can force a specific language/locale on users. The policy allows locale constraints only when they are explicitly justified or when users are given a choice, neither of which appears here.
No suspicious patterns detected.