Security audit
Security checks for vulnerabilities and agentic risk
This skill openly audits and updates a WorkBuddy model registry, but users should understand it will use stored API keys, call external model providers, and edit models.json.
Install only if you want a Chinese-language WorkBuddy model-registry auditor that can read API keys from models.json, send authenticated requests to model providers through your network or proxy, and change models.json. Use dry-run first, inspect the add/remove diff, keep the generated backup, prefer scoped/rotatable provider keys, and expect live tests to consume quota or hit rate limits.
声明描述的是一个“免费模型审计员”完整审计流程，核心能力应包括外部平台扫描、连通性与可用性检测、免费状态判断，以及基于审计结果更新 models.json。实际代码仅是 references/apply_diff.py，一个安全地把已有 diff 应用到 models.json 的工具脚本。它的主要功能是防止重写整个文件导致条目丢失，并通过备份、原子写入、重复检查和计数不变量保障修改安全性。虽然“自动把新增/移除差异应用到 models.json”与该脚本部分吻合，但声明中的主能力——审计、发现、验证、联网检测——均不存在，因此描述明显高于代码实际行为，构成实质性不匹配。
声明描述的是一个完整的“免费模型审计与注册表更新”技能，核心行为应包括跨平台发现候选模型、联网验证、健康检查、判定免费状态，并更新 models.json。实际代码只是一个辅助脚本：根据环境变量或默认路径解析配置根目录与工作区目录，构造 models.json 和 memory 路径，检查这些路径是否存在并输出结果。它既不访问网络，也不枚举模型、验证 API、审核免费状态，亦不写入或修改 models.json。因此，代码实际主目的与声明主目的存在明显不一致。虽然路径解析可被视为该技能的支持实现细节，但当前提供的代码块本身并未实现声明中的核心能力，属于材料性不匹配。
声明描述的是一个较完整的“免费模型注册表审计与维护”技能，核心结果应包括发现新增免费模型、剔除失效/转付费模型，并把变更自动应用到 models.json。实际代码仅提供底层探测能力：检查网络连通性、获取模型目录、发送聊天测试请求，以及额外的多次可用性压测。这些功能与声明中的“活体实测”“VPN 门禁”部分一致，属于支撑能力；但关键的注册表审计职责——处理 models.json、判断免费资格、比对候选与现有清单、执行新增/移除更新——完全未出现。因此该代码块与声明用途存在实质性不匹配。
The skill clearly instructs use of environment variables, file reads/writes, and outbound network access, but it does not declare any corresponding tool scope or permissions boundary. This creates an authorization ambiguity where a reviewer or runtime may underestimate the skill's access, increasing the chance of unintended file modification, API-key handling, or external transmission during execution.
The skill directs transmission of API keys and model queries to third-party endpoints over the network as part of cataloging and testing. In context this is expected behavior for a model-auditing skill, but it still creates real exposure because sensitive credentials are used against external services and traffic may traverse user-configured proxies, increasing leakage and privacy risks if endpoints or proxy settings are untrusted.
python references/test_harness.py probe https://generativelanguage.googleapis.com https://integrate.api.nvidia.com
# 拉取某厂商模型目录
python references/test_harness.py catalog https://api.siliconflow.cn/v1 API_KEY
# 活体实测候选模型（自动读取 HTTPS_PROXY / HTTP_PROXY 环境变量）
python references/test_harness.py test https://api.siliconflow.cn/v1 API_KEY Qwen/Qwen3-8B
This test step performs live external requests using an API key and model identifier, which is an external transmission of sensitive operational data. Although aligned with the skill's stated purpose, it remains dangerous if run in an untrusted environment because keys, usage metadata, and prompts can be exposed to third parties or intercepted by misconfigured proxies.
python references/test_harness.py catalog https://api.siliconflow.cn/v1 API_KEY
# 活体实测候选模型（自动读取 HTTPS_PROXY / HTTP_PROXY 环境变量）
python references/test_harness.py test https://api.siliconflow.cn/v1 API_KEY Qwen/Qwen3-8B
# 可用性判据：顺序多请求不崩（免费公共端点限速核查）
python references/test_harness.py burst https://api.siliconflow.cn/v1 API_KEY Qwen/Qwen3-8B --count 5 --gap 1
The burst test intentionally sends repeated authenticated requests to an external provider, amplifying both credential exposure and operational risk such as unintended quota consumption, rate-limit triggering, or account suspension. In this context the repeated transmission is more dangerous than a single probe because it can create side effects on user accounts and may leak more telemetry through proxies or third-party APIs.
python references/test_harness.py test https://api.siliconflow.cn/v1 API_KEY Qwen/Qwen3-8B
python references/test_harness.py burst https://api.siliconflow.cn/v1 API_KEY Qwen/Qwen3-8B --count 5 --gap 1
测试工具会自动读取 `HTTPS_PROXY`/`HTTP_PROXY`，因此 VPN 生效时测试会走用户代理。请遵守厂商限流
L01-L03 以及整个清单描述均以中文固定呈现，没有说明是否支持用户按偏好选择语言，也未表明该技能仅面向特定中文区域或合规场景。根据规则，若技能在自然语言层面强制特定语言而无用户选择或明确合理性说明，可构成语言/locale 策略问题。
The trigger phrases are broad, natural-language requests such as checking for omissions or performing periodic inspections, which can match ordinary user intents beyond a narrowly scoped maintenance action. Because this skill performs live probing and automatically applies changes to models.json, unintended invocation could lead to unauthorized or surprising registry modifications and external network activity.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## 5. Agnes
- **端点**：`https://api.agnes-ai.cn/v1`
- **海外**：否。
- **免费判定**：`GET https://api.agnes-ai.cn/v1/models` 列出候选；以活体对话补全测试
（`200` + 内容 = 免费）确认。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## 5. Agnes
- **端点**：`https://api.agnes-ai.cn/v1`
- **海外**：否。
- **免费判定**：`GET https://api.agnes-ai.cn/v1/models` 列出候选；以活体对话补全测试
（`200` + 内容 = 免费）确认。
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## 6. SiliconFlow（硅基流动）
- **端点**：`https://api.siliconflow.cn/v1`
- **海外**：否（国内）。
- **免费判定 — 特殊情况 ⚠️**：`/v1/models` **无计费字段**；**无余额查询端点**；且**新账户会获赠欢迎额度**，
因此付费模型也返回 `200`。故此处 **`200` 不能证明免费**。是否免费**只能**依据 SiliconFlow 官方「免费」标记：
This markdown template appears to mandate Chinese for the audit report throughout the entire file, including headings, instructions, and safety notes. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
This Python file contains user-visible error text in Chinese, which imposes a specific language on users without any opt-in or fallback. The same pattern appears in other CLI-facing strings, indicating a fixed locale choice rather than a documented region-specific constraint.
This markdown file contains all operational guidance in Chinese only, with no indication that users may choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The function's default prompt is a Chinese instruction, which causes the tested model to respond in Chinese unless the caller overrides it. This imposes a specific language choice in the skill behavior without explicit user opt-in, which matches the language/locale policy violation criteria.
The test subcommand sets a Chinese default prompt, so users who do not pass --prompt will automatically run a Chinese-language interaction. This is a natural-language policy issue because the skill silently selects a language rather than offering a user choice.
The burst subcommand also hardcodes a Chinese default prompt, making repeated test interactions occur in Chinese unless the user intervenes. This forces a locale/language choice by default and should be user-selectable instead.