Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward local SKILL.md checker that reads a user-chosen skill file and writes an HTML report, with no evidence of hidden network, credential, or persistence behavior.
Install this if you want a local helper to audit SKILL.md files. Expect it to run a Python script, read the target SKILL.md you provide, and create an HTML report. Review the report path before use and remember that the checks are strict heuristics with Chinese/bilingual labels, so do not treat every finding as definitive specification truth.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
fallback_en_message = finding.message
fallback_en_suggestion = finding.suggestion
if finding.rule_id in RULE_TRANSLATIONS:
return RULE_TRANSLATIONS[finding.rule_id]
return fallback_en_message, fallback_en_suggestion
The skill description 'Helpful skill.' is too vague to define a safe activation boundary, which increases the chance the agent will invoke this skill in unintended contexts. Overbroad activation can lead to incorrect auditing behavior, misleading reports, or use on inputs outside the skill's intended scope.
The workflow steps are generic and do not constrain inputs, validation criteria, or refusal conditions, making the skill easy to apply to arbitrary targets without clear limits. This can cause inconsistent or unsafe behavior because the agent lacks concrete rules for what to review, how to assess compliance, and when to stop or escalate.
Without declared permissions the skill's intent is opaque and cannot be validated.
The description says the skill will "generate a Chinese HTML report," which forces a specific language choice as part of the skill behavior. This is a natural-language locale policy issue because the file does not indicate that the user can opt in to Chinese output or choose another language.
Lines L34-L35 require outputs to be 不通过 and 通过, which imposes a specific language for user-facing results. The file does not provide user opt-in, alternative locale support, or a documented reason that the skill must operate in Chinese only.
Multiple user-facing messages are emitted only in Chinese, and the generated HTML declares lang="zh-CN" while defaulting the language view to English/Chinese behavior without asking the user which locale they prefer. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy violation.
The manifest describes checking whether a skill file follows the specification, which implies evaluating valid specification files broadly. Here the code only accepts a very restricted subset of YAML/frontmatter shapes, rejects nested structures except metadata, and hardcodes its own accepted top-level fields and heuristics, so it can misclassify spec-compliant files as invalid.
The HTML report sets <html lang="zh-CN"> regardless of user preference or target audience. This is a locale policy issue because it imposes a specific locale setting rather than offering user selection or documenting a justified region-specific requirement.
The description says to use the skill when an agent needs to review a SKILL.md, which is a broad activation condition that could match many ordinary review tasks. It does not define clearer trigger phrases, boundaries, or exclusion cases to distinguish when this skill should be invoked versus other documentation-review skills.
This test file asserts status values such as "通过" and "不通过", which hard-code a specific language expectation in the skill behavior. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern, and no opt-in or locale selection is shown here.
Multiple assertions require Chinese-only status text across several test cases, reinforcing that the audited skill behavior is expected to be fixed to one language. Because the file does not show any user choice or justified regional constraint, this appears to violate the language/locale policy.
The manifest text uses Chinese for the short description while the default prompt is in English, with no indication that the user can choose their preferred language. This can be a language/locale policy issue because the skill presents language behavior without explicit opt-in or documented justification.
The implementation adds semantic checks such as required trigger wording markers, minimum body length, heading presence, and guidance keyword counts. Those are quality heuristics beyond straightforward specification compliance, so the behavior is somewhat broader than the manifest's stated purpose of auditing against the specification.
This code creates parent directories and writes a report file, which is a file-system modifying operation. While the CLI help mentions the output path behavior, there is no confirmation prompt or user-facing warning immediately around the write, and the operation occurs even when the user does not explicitly pass --out.
No suspicious patterns detected.