Security audit
Security checks for vulnerabilities and agentic risk
This skill is a narrow UAPI documentation wrapper for fetching programmer-history events by month and day, with no executable code or hidden local behavior.
Installers should understand that this skill may contact uapis.cn to retrieve programmer-history events and may ask for a UAPI key if anonymous quota is exhausted. Consider narrowing the `programmer` trigger and adding bilingual or language-matching guidance, but no malicious or high-impact behavior was found.
The manifest description mixes Chinese and English but frames the skill in a way that presumes Chinese-language interaction (使用 UAPI 的“程序员历史事件”单接口 skill) without offering a user language choice. Under the policy, locale or language constraints should be explicitly optional or justified rather than implicitly imposed.
The trigger keyword list includes the standalone term programmer, which is overly broad and likely to match many unrelated user requests. This can cause unintended skill invocation and misroute tasks to this API, increasing the chance of irrelevant external calls or bypassing more appropriate skills.
The file presents all user-facing instructions and descriptions exclusively in Chinese, which can amount to a language/locale policy issue when no opt-in or alternative language is offered. The documented content does not state that the skill is region-specific or otherwise justified as Chinese-only.
The document is written primarily in Chinese and presents the skill usage guidance in that language without offering a language choice or stating that the skill is region-specific. This can violate language/locale policy when users have not opted into Chinese-language interaction.
