Security audit
Security checks for vulnerabilities and agentic risk
This skill only lists the current working directory contents with a bundled read-only script, with no network, persistence, or file modification behavior observed.
Before installing, understand that the skill will reveal the current directory path and a short list of filenames from the directory where it is run. Use it only in directories you are comfortable having summarized, and prefer an updated version that respects the user's requested language.
The skill instructs the agent to run a local inspection script and read from the working directory, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where the runtime may permit broader file access than intended, increasing the chance of unintended disclosure of local data during 'read-only' inspection.
Line L14 states 'Return concise Chinese output,' which imposes a specific language regardless of user preference. The policy allows locale or language constraints only when the user is given a choice or the constraint is clearly justified, neither of which is present here.
No suspicious patterns detected.
