Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local encoding and decoding utility with no hidden network, persistence, or privilege behavior found.
Reasonable to install for local encoding and decoding tasks. Be careful with sensitive inputs, and use the JWT helper only for inspection; do not make security decisions from decoded JWT contents without validating the signature, issuer, audience, expiration, and accepted algorithms.
The user-facing README content describing the skill's purpose and features is written in Chinese, while no alternative language option or opt-in is provided. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly justified.
The skill explicitly demonstrates JWT decoding and notes that signature verification is not performed, but it does not clearly warn that decoded payload contents are untrusted until the token's signature, issuer, audience, expiration, and algorithm are validated. This can lead downstream users or agents to treat attacker-controlled claims as authoritative, enabling authentication or authorization mistakes.
This code file contains a Chinese-only title and throughout the script all user-facing print strings are in Chinese, which imposes a specific language on users. The file does not offer any opt-in, fallback, or justification for the locale restriction, matching the language/locale policy violation criteria.
This code file contains user-facing natural-language descriptions entirely in Chinese, including the module title and class/method docstrings. Under the policy, a skill should not impose a specific language or locale unless it offers opt-in or clearly documents a justified regional constraint, which is not present here.
SQP-3 适用于所有文件。该技能说明从标题后的主要内容开始均为中文，未提供其他语言选项，也未说明该技能为何必须限定中文；这可能对非中文用户形成默认语言强制。根据规则，若无用户选择或合理的区域性说明，应视为自然语言层面的策略风险。
The natural-language comments are written entirely in Chinese in a generic requirements file, which can impose a specific language context on maintainers or users without any opt-in or justification. This matches the policy category for language or locale constraints expressed in natural language.
The module docstring includes Chinese text in a user-visible natural-language string context. Under the policy rule for language/locale, forcing a specific language without user opt-in can be a violation, and this file does not indicate any language selection or justification.
The final printed status message is a natural-language string shown to the user and is hardcoded in Chinese. The file does not provide any language selection, fallback, or documented locale constraint, so this may violate the language/locale policy.
No suspicious patterns detected.
