Security audit
Security checks for vulnerabilities and agentic risk
The skill has a coherent brand-knowledge-base purpose, but it sends full uploaded materials to an external LLM and automatically keeps a raw source bundle, which users should review carefully before installing.
Install only if you are comfortable sending the full contents of provided brand materials to the configured OpenAI-compatible API provider and keeping a raw source_bundle.md in the output. Do not upload secrets, confidential customer records, regulated data, or unredacted transcripts unless your organization approves that handling. Consider updating vulnerable pinned dependencies before processing PDFs.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
api_key = os.getenv("OPENAI_API_KEY")
base_url = os.getenv("OPENAI_BASE_URL")
if not api_key:
print("❌ 错误: 找不到 OPENAI_API_KEY 环境变量，请在 .env 文件中设置。")
sys.exit(1)
return OpenAI(api_key=api_key, base_url=base_url)
Pinning pypdf to 4.3.1 is a true vulnerability because the listed advisories indicate denial-of-service conditions such as infinite loops, excessive runtime, and high memory consumption during PDF parsing. This skill explicitly processes uploaded brand documents, so malicious or malformed PDFs are a realistic input and could exhaust CPU or memory, hang the worker, or disrupt service availability.
The skill advertises executable/runtime behavior and file/env access patterns but does not declare any explicit tool scope or permissions boundary. This creates ambiguity about what the skill may access at runtime, increasing the risk of over-broad file reads/writes or environment secret exposure if the host grants default capabilities.
The mandated first-reply pattern is written entirely in Chinese and is presented as what the assistant should lead with when the skill is first invoked. There is no surrounding instruction offering the user a language preference or limiting the skill to a Chinese-only context, so this creates a locale/language policy issue.
The document is predominantly written in Chinese and includes a Chinese-only status/update line, but it does not state that the skill is region-specific or that users may choose another language. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy concern.
normalize_package sets metadata["language"] = "zh-CN" when no language is supplied, and the script's user-facing prompts/messages are written in Chinese throughout. This creates a default locale constraint without any visible user choice or clear justification that the tool is intended only for a China-specific context.
The skill sends compiled source documents and intake content to an external LLM API for extraction, analysis, and asset generation without an explicit user-facing disclosure or consent checkpoint at the transmission point. If the uploaded brand documents contain confidential business, customer, or contractual information, this can violate user expectations, internal policy, or data-handling requirements.
The prompt content is written as a direct instruction in Chinese and does not offer any language choice or opt-in mechanism. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless clearly justified as region-specific.
The prompt hard-requires Chinese output and Chinese-language framing without any user choice or documented business constraint. This can cause unauthorized locale steering, reduce usability for non-Chinese-speaking users, and create compliance or review errors if downstream consumers expect another language.
The prompt content is written as a direct instruction in Chinese and tells the model what role to assume without offering the user a language choice. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is clearly justified, which is not documented here.
The prompt hard-codes Chinese-language behavior for FAQ generation without any user-language selection or documented business requirement. This can cause unsafe or unusable outputs for users expecting another language, increase misunderstanding in downstream reuse, and create compliance or accessibility issues when the generated content is published or consumed in the wrong locale.
The prompt content is entirely written as mandatory Chinese instructions and does not offer any user opt-in or language selection. Under the policy, forcing a specific language or locale without choice is a natural-language policy violation unless clearly justified as region-specific.
The skill instructions are entirely written in Chinese and direct the assistant behavior in Chinese without indicating that users may choose another language. This can violate language/locale policy when a skill implicitly forces a specific language absent user opt-in or documented regional justification.
The prompt explicitly solicits sensitive business and contact data, including emails, phone numbers, addresses, work hours, and internal compliance boundaries, but provides no privacy notice, data minimization guidance, or handling constraints. In a knowledge-base-building skill, this increases the risk of oversharing, accidental retention of personal data, and collection of proprietary information beyond what is strictly necessary.
The file’s operational instructions are entirely in Chinese and direct the model in that language, without stating that the user may choose another language or locale. This is a natural-language policy concern because it imposes a specific language by default rather than offering an explicit opt-in or documented regional justification.
Pinning python-dotenv to 1.0.0 is a real supply-chain risk because that version is reported as vulnerable, including a symlink-following issue in set_key that can enable arbitrary file overwrite in workflows that modify .env files. In an agent skill environment, this becomes more concerning if the skill or surrounding tooling writes environment data or handles attacker-controlled paths, because it could lead to tampering with configuration or sensitive files.
The manifest template sets "language": "zh-CN" as a default, which imposes a specific language/locale in a reusable skill artifact. Because the file does not indicate that this template is region-specific or that users may opt into a different language, it creates a natural-language locale policy concern.
The manifest template sets language: "zh-CN" as a fixed default, which is natural-language policy-relevant because it prescribes a specific locale without any opt-in, fallback, or documentation that the skill is region-specific. This can lead downstream skills or content generation workflows to force Chinese output regardless of user preference.
The intake form explicitly solicits a broad set of potentially sensitive business information, including contact details, internal sales/support channels, addresses, compliance boundaries, customer cases, and interview/transcript materials, but provides no notice about privacy expectations, retention, access scope, or redaction guidance. In a document-upload workflow, this increases the chance that users disclose more sensitive data than necessary and that confidential information is collected without informed handling safeguards.
The title and description specify a standardized messaging library entirely in Chinese and instruct consistent output aligned to brand tone, but the file does not offer any language or locale opt-in. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly justified.
The manifest only describes transforming uploaded brand materials into a standardized knowledge package. The code additionally loads local environment configuration and consumes OPENAI_API_KEY/OPENAI_BASE_URL, which is an infrastructure capability not reflected in the stated purpose and exposes broader local configuration access than the manifest suggests.
The skill writes a source_bundle.md containing the raw uploaded materials into the output directory. That creates unnecessary data retention and secondary exposure of potentially sensitive source documents beyond the stated purpose of producing a normalized brand knowledge package.
The file presents the entire FAQ template in Chinese, including the title and all user-facing questions, with no indication that language selection is optional or that the template is intended only for a Chinese-speaking audience. This can violate language/locale policy expectations when a skill should not force a specific language without user opt-in.
The file title and description require users to work in Chinese, but there is no indication that the language is optional or that the template is intended only for a Chinese-speaking context. This can violate language/locale policy when users are not given an explicit choice or opt-in.
The form title is bilingual, but the actual instructions and fields are written entirely in Chinese, which can impose a language constraint on users without opt-in. Under SQP-3, forcing a specific language without user choice is a natural-language policy concern unless the locale limitation is explicitly documented and justified.
No suspicious patterns detected.