Security audit
Security checks for vulnerabilities and agentic risk
This skill manages LegionClaw skill files as advertised, with persistent file changes that are expected for that purpose and no evidence of hidden exfiltration or destructive behavior.
Install only if you intend to let the agent create and modify LegionClaw skills in the skills workspace. Review generated skills before relying on them, and keep host permissions limited to the intended skills directory and bundled helper scripts.
声明描述的核心功能是“创建、修改和管理”技能文件包，强调交互式操作；而提供的代码只执行静态校验：读取目标目录下的 SKILL.md，解析 YAML frontmatter，检查 name/version/description/disable-model-invocation 字段和正文必需章节，并输出错误信息后退出。它不会创建文件、修改文件、管理文件包，也没有任何交互式流程。虽然校验可能是技能开发流程中的辅助环节，但该代码的主要目的与声明的主要用途明显不一致，因此应判定为描述与行为不匹配。
Referenced artifact was not completely inspected
**检索方式**：遍历 `skills/` 下各子目录，阅读 `SKILL.md` frontmatter 与「何时使用」「目标」章节，判断能力是否匹配。
Referenced artifact was not completely inspected
**检索方式**：遍历 `skills/` 下各子目录，阅读 `SKILL.md` frontmatter 与「何时使用」「目标」章节，判断能力是否匹配。
The skill instructs the agent to read and write under the skills workspace and to execute local helper scripts, but the manifest does not declare any explicit tool scope such as allowed-tools or permissions. This creates unclear execution boundaries and increases the chance that a host agent grants broader filesystem access than intended, enabling unintended file modification if the skill is triggered.
The trigger phrases include broad, everyday expressions like '创建技能', '修改技能', and 'skill manager', which can match common user requests with little indication that filesystem changes and script execution may follow. Over-broad activation can cause the skill to run in contexts the user did not intend, leading to unreviewed file creation or modification in the workspace.
The guidance says the common phrasings are 'not limited to' the listed examples, making invocation boundaries effectively open-ended. In a skill that can inspect the skills directory, create files, and run local scripts, ambiguous activation materially raises the risk of accidental execution and unintended workspace changes.
The trigger guidance encourages activation on generic requests such as merely needing a core function, which can cause the skill to engage when the user did not explicitly intend to invoke it. In a skill-manager context, overbroad activation increases the chance of unintended file creation or modification and can chain into more sensitive actions if downstream skills or templates include execution or network behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -sS -X POST "https://example.com/api" \
-H "Content-Type: application/json" \
-d '{"userId":"${USER_ID}"}'
The API-call template instructs authors to send data to external endpoints but does not require any user-facing disclosure, consent, or data-sensitivity check before transmission. This is dangerous because derived skills may exfiltrate identifiers, prompts, or business data over the network without the user's informed approval.
Although shown as a template, this example directly normalizes making arbitrary external POST requests without requiring trust validation, consent, or sensitivity review of transmitted fields. Because this document is a skill-writing spec, insecure examples are likely to be copied into real skills, making the omission materially risky in context.
curl -sS -X POST "<API_URL>" \
-H "Content-Type: application/json" \
-d '{"field1":"value1","field2":"value2"}'
The file presents its usage documentation entirely in Chinese, and later generates a SKILL.md template whose headings and instructional text are also fixed in Chinese. This imposes a specific language/locale on users and generated artifacts without offering a language selection or documenting a justified regional constraint.
The template stored in SKILL_TEMPLATE is fully written in Chinese, including section headings and placeholder guidance, so every initialized skill inherits that locale by default. Because the script does not offer any alternative language selection, this is a natural-language locale policy concern.
This code file contains human-readable usage and status text only in Chinese, including the module docstring and command-line usage guidance. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no locale choice or justification is provided.
No suspicious patterns detected.