Security audit
Security checks for vulnerabilities and agentic risk
This skill fetches public Shanghai residency notice pages and opens the results in a browser, with no evidence of persistence, credential access, exfiltration, or destructive behavior.
Install only if you are comfortable with the skill making requests to sh-italent.com and opening notice pages in your local browser by default. Use the --no-browser option if you only want printed results, and do not rely on the company/person examples for filtering because the inspected code does not implement that filtering.
If the skill actually performs AppleScript or GUI automation to control Safari, that is a materially more powerful capability than a normal web query and is not clearly disclosed in the skill description. Local GUI automation can interact with user applications in unexpected ways, expanding the attack surface beyond simple data retrieval.
If the skill actually performs AppleScript or GUI automation to control Safari, that is a materially more powerful capability than a normal web query and is not clearly disclosed in the skill description. Local GUI automation can interact with user applications in unexpected ways, expanding the attack surface beyond simple data retrieval.
The skill declares execution of a Python script that performs network access and local command execution, but it does not define any explicit tool scope such as allowed-tools or permissions. This weakens sandboxing and review guarantees because an agent may grant broader capabilities than users expect for a simple public-notice lookup skill.
Broad trigger phrases like '上海落户' or '落户公示' increase the chance of accidental invocation for unrelated conversations about household registration. Mis-triggering is security-relevant here because this skill can execute code, perform network access, and open local browser windows without a high-confidence match to user intent.
The trigger keyword section lists several ambiguous phrases without boundaries or negative examples, making accidental activation more likely. Because the skill has side effects beyond plain text generation, ambiguity in routing can directly lead to unintended code execution, network requests, or browser launches.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
'''
try:
subprocess.run(['osascript', '-e', applescript], check=True)
return True
except:
# 回退到 webbrowser
技能清单描述聚焦于“查询上海落户公示信息”，而代码进一步声明支持按公司（--company）和按人员（--person）查询指定名单/人员公示。但这两个参数在解析后从未参与任何抓取、过滤或匹配逻辑，实际行为仅是获取并展示最新公示链接与标题，未执行所宣称的定向查询。
The script does more than query and print public notice data: it also drives the local Safari browser via AppleScript and opens multiple pages automatically. Local GUI control is a side effect not required for the stated purpose, and it can surprise users, expand the script's capabilities, and normalize desktop automation in a data-retrieval skill.
Using AppleScript to control Safari is not justified by the core function of fetching public notices, and it grants the script influence over a local GUI application. Even though the URLs are currently constrained to the target site, this creates unnecessary local-action capability and increases risk if parsing logic or upstream content changes.
整个技能文件从名称、描述、触发词到输出示例均固定为中文，未说明是否支持其他语言或允许用户按偏好选择语言。若组织要求技能不得无用户选择地强制特定语言，这种默认单一语言呈现可能构成自然语言策略问题。
文件头注释将该工具描述为“抓取上海国际人才网的落户公示信息并使用浏览器打开”，这暗示打开浏览器是固定行为。但主逻辑中通过 --no-browser 参数可只输出结果而不打开浏览器，文档对实际行为形成了直接不一致的表述。
The file's comments and all user-visible prompts are in Chinese, and the script does not offer any language or locale selection. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.