Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed SCI journal lookup helper with expected network/browser use and no hidden persistence, credential access, or destructive behavior.
Install this only if you are comfortable with it querying external journal sites and, when using --letpub, letting the agent open LetPub in a browser and close/stop the browser session afterward. The skill would benefit from clearer bilingual documentation, but the inspected behavior is purpose-aligned.
The skill description, headings, examples, and operational instructions are entirely in Chinese, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
This file’s docstring and command descriptions are exclusively in Chinese, and there is no indication that users can select another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The module docstring and CLI description present this as an SCI journal query tool that queries XinRui by default and LetPub optionally. However, the LetPub path is implemented by spawning another Python script via subprocess rather than by direct querying logic, which introduces process-execution capability not justified by the stated purpose of a lookup tool.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
import subprocess
# 使用扩展后的全称查询 LetPub，而不是原始简称
letpub_keyword = keyword if keyword else args.keyword
result = subprocess.run(
[sys.executable, str(letpub_script), letpub_keyword],
capture_output=True,
text=True
该技能说明全文均以中文呈现，未见提供其他语言选项、用户语言偏好说明，或明确声明该技能仅面向特定中文用户群体。根据语言/locale 政策，若技能实际上强制单一语言而无用户 opt-in，属于自然语言层面的潜在政策问题。
The natural-language description at L004 is written only in Chinese, which can indicate a language-specific constraint without offering user choice or documenting that the skill is intended only for a Chinese-speaking context. Under the policy rule, locale or language restrictions should be opt-in or clearly justified.
The natural-language description is presented only in Chinese, which can impose a language constraint on users without opt-in or explanation. Under the language/locale policy, this is a potential issue unless the skill clearly documents that it is intentionally region- or language-specific.
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This reference file presents all instructional and descriptive content exclusively in Chinese and does not indicate any optional locale or audience constraint.
This Python file contains only Chinese-language natural-language strings for the docstring, usage guidance, status messages, and formatted output. That imposes a specific language choice on users without offering an alternative or opt-in, which matches the language/locale policy violation criteria.
No suspicious patterns detected.