Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed PikPak onboarding guide with a small offline command previewer and no evidence of hidden execution, credential collection, persistence, or exfiltration.
Before using it, read the referral disclosure and only accept the invitation code if you want to. Treat generated commands as a preview: run PikPak account, registration, or task commands only after confirming the current account and the link/content you provide are yours to use.
The skill explicitly states it reads a bundled config.json, which means it requires file-read capability, but it does not declare a restrictive tool scope such as permissions or allowed-tools. Without an explicit scope, a host may grant broader file access than intended, weakening least-privilege guarantees and making policy enforcement dependent on external host behavior.
This markdown file contains operational guidance only in Chinese, which can effectively force a specific language on users or maintainers. Under the policy, language constraints should be opt-in or clearly justified as locale-specific.
This code emits user-facing natural-language strings only in Chinese, which can force a specific language/locale on users without opt-in. The policy allows locale constraints when documented and justified, but no such justification or language choice appears in this file.
No suspicious patterns detected.
