Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese-language AgentSkill reviewer that reads user-selected skill files and writes local review reports, with no evidence of hidden execution, exfiltration, or persistence.
Install only if you are comfortable with a Chinese-language review workflow that reads the skill directory you point it at and creates a Markdown report in the working directory by default. Confirm the target path and output path before use, especially in repositories where generated files should be controlled.
声明描述的是一个面向质量审查的分析型 skill，应生成关于内容质量、结构、清晰度和冗余的专业报告。但实际代码仅做文件读取与近似 token 数计算，输出的是 token 消耗分析和基于总量的简单优化建议。它没有实现任何与“质量评审”直接对应的检查逻辑，也没有生成所声明的专业质量报告。虽然 token 统计可作为辅助信息，但这里已构成主要功能偏离，因此描述与实际行为明显不符。
声明描述的是一个面向质量审查的 skill reviewer，侧重内容质量、结构、文档清晰度和冗余问题；而代码核心逻辑并未实现这些通用质量评审能力。它专门读取两个路径下的 SKILL.md，做版本间一致性/保真度检查：提取 description 关键词比较、对比 Markdown 标题是否丢失、检查 markdown/代码中的文件引用是否缺失、确认新增 scripts 引用是否对应存在文件。这表明其主要用途是“优化前后 skill 的逻辑对齐验证”，而不是“评审 skill 质量并生成专业报告”。因此属于主要目的和能力的实质性不一致。
Referenced artifact was not completely inspected
读取目标 skill 的 `SKILL.md`：
The skill instructs the agent to read target skills and save review reports to disk, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where file read/write behavior may occur more broadly than users expect, increasing the chance of unintended local file access or silent file creation.
The trigger phrases are broad enough to match generic requests like reviewing or analyzing a skill, which can cause the skill to activate outside its intended scope. Overbroad invocation increases the risk of unintended file inspection, report generation, or other side effects when a user did not clearly request this specific workflow.
The skill states that reports are automatically saved to the working directory, but it does not require user consent or provide a warning before creating files. Silent file creation can overwrite expectations, clutter repositories, or become a stepping stone for unsafe write behavior in environments where agents have filesystem access.
This Python file contains natural-language docstrings and CLI output entirely in Chinese, including the skill description and usage/help text. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no alternative language option or justification is provided here.
This code file contains user-facing natural-language text that forces a specific language/locale. The docstring and later CLI messages are presented only in Chinese, and the file does not provide any opt-in, selection mechanism, or justification that it is intended solely for a Chinese-language environment.
The command-line help, error messages, report headings, and success/failure outputs are all emitted only in Chinese. Because the script does not offer a user language choice or state a justified locale restriction, this is a natural-language policy issue under the language/locale rule.
The phrase "默认以中文输出" imposes a language preference as the default behavior, and the file does not indicate that users can select another language. This is a natural-language policy concern because it sets a locale/language behavior without explicit user choice.
This markdown template forces a single language for all report headings and guidance, such as the title and all section labels in Chinese. The file does not offer any user language selection or explain that the template is intended only for a Chinese-speaking context.
This markdown file contains user-facing instructional content exclusively in Chinese, and there is no indication that the skill is region-specific or that users may choose another language. That can violate organizational language/locale policy when no opt-in or justification is provided.
This is a code file, so SQP-3 applies to natural-language strings and comments within it. The docstring, usage message, errors, and output all force Chinese-language interaction, which can violate a language/locale policy when no user opt-in or justification is provided.
No suspicious patterns detected.