Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-first long-document writing workflow that creates and updates related Markdown and progress files, with no evidence of hidden code, exfiltration, or deceptive behavior.
Install only if you want a Chinese-first, file-backed writing assistant. Expect it to read relevant workspace documents, create or edit Markdown files, and save progress in `.doc-progress-*` files near the document; approve any pandoc conversion command before running it.
The trigger description is broad enough to capture ordinary document-writing requests, including generic requests to write any document expected to exceed three chapters. This can cause the skill to activate in situations the user did not intend, leading to unexpected file reads/writes, workflow takeover, and persistence behavior that exceeds normal response expectations.
The resume trigger phrases such as 'continue writing the document' or 'pick up the previous document' are ambiguous and may match unrelated ongoing writing tasks. In context, that ambiguity is more dangerous because the skill is designed to search for progress files and resume persisted state, potentially pulling in or modifying files the user did not mean to reopen.
The rule '全程中文沟通' imposes a fixed language requirement as a default operating policy. This is a natural-language policy concern because it does not offer the user a language choice or indicate that Chinese is optional based on user preference.
The skill instructs automatic creation of the document file and ongoing writes to a progress file, but the high-level description does not clearly warn users that files will be created and updated on disk. This is risky because users may invoke what appears to be a conversational writing aid without realizing it will persist content, metadata, and decisions across sessions.
The skill explicitly suggests using pandoc to convert output to Word, which introduces external tool execution outside the core conversational writing workflow. Even though pandoc is common and the instruction is framed as assistance, invoking external processes expands the attack surface and can surprise users in environments where tool execution is sensitive or restricted.
This markdown example is entirely written as a Chinese-language interaction and presents the skill behavior in that locale only. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation when no alternative language choice or justification is provided.
The pandoc conversion step mentions assisting with Word conversion but does not warn that this may require invoking an external tool or process. In a tool-enabled environment, that lack of notice can lead to unexpected process execution and environment-dependent side effects.
In this markdown skill example, the AI states it will write content and then indicates '（写入文档文件）', but the description does not warn the user that the skill modifies files. For markdown files, omissions of warnings about behaviors affecting user data should be flagged when file-modifying behavior is depicted without disclosure.
No suspicious patterns detected.
