Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local UUID analysis helper with no evidence of network access, credential handling, persistence, or destructive behavior.
Installers should treat this as a small local UUID inspection tool. Review the stale manifest if you rely on package hashes, and only use batch mode on files you intentionally choose because UUID v1 analysis can reveal timestamps and embedded node identifiers.
The manifest description says 'Utilisez pour analyser, valider ou auditer,' which is a very broad activation description and does not clearly constrain when this skill should be selected over other tools. Because this is a manifest/markdown file, vague trigger language can cause unintended invocation across many ordinary analysis contexts.
Without declared permissions the skill's intent is opaque and cannot be validated.
The file is entirely written in Chinese, including the manifest description and user-facing instructions, with no indication that language is selectable or that the skill is specifically intended for a Chinese-only audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill description and usage guidance are presented in French throughout the README, including core headings and explanations. Under the policy rule, a skill should not impose a specific language unless it offers opt-in or clearly documents a justified regional constraint, neither of which is present here.
The file presents the skill description and instructions in French, but it does not indicate that French is optional, user-selected, or required for a region-specific reason. This can violate language/locale policy expectations when a skill appears to force a specific language without user opt-in.
This code file contains user-facing natural-language documentation and command-line messages in French, including usage/help text and limitations, with no indication that language choice is configurable or optional. That creates a locale-policy concern under the rule because the skill appears to impose a specific language by default rather than offering opt-in or documenting a justified regional scope.
The module documentation says "Pas de génération de UUID (analyse seulement)," which frames the tool as analysis-only, but the documented CLI usage includes --batch file.txt, and the implementation later opens an arbitrary file path to read UUIDs for processing. While still related to analysis, this is a real operational capability beyond pure in-memory UUID parsing and is not reflected in the high-level intent wording.
No suspicious patterns detected.
