Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrowly scoped public-website collection helper that creates an Excel export, with some quality and overwrite caveats but no evidence of deception or malicious behavior.
Before installing, understand that this skill may open the Zibo public-resource website in a browser and write an Excel file locally. Choose the output path yourself, avoid overwriting existing files, and use a separate browser profile if you do not want the agent using your connected Chrome session.
声明描述的核心能力是“从公共资源交易网站抓取项目信息并保存到Excel”。但提供的代码片段只使用 xlsx 和 fs 在本地创建一个 Excel 文件，包含固定表头和列宽设置，并创建输出目录后写盘。projects 数组中没有真实抓取结果，且代码中不存在任何网络请求、网页解析、站点访问、日期过滤或公告类型处理逻辑。因此，该代码的实际行为只是导出/创建一个空的Excel模板，并不能代表声明中的主要用途，属于实质性描述不符。
The trigger conditions are broad enough to activate on generic information-gathering requests, which can cause the agent to invoke browser automation and file-export behavior outside the user's narrowly intended task. Overbroad routing increases the chance of unintended website access, unnecessary data collection, or local file creation in contexts where this specialized skill was not explicitly requested.
The skill instructs creation of a local Excel file, including a hardcoded Windows path, without warning that execution may create or overwrite files on the user's system. In an agent context, silent local file writes are risky because users may not realize persistent artifacts will be created or that an existing file at the target path could be replaced.
No suspicious patterns detected.
