Security audit
Security checks for vulnerabilities and agentic risk
This skill locally reads user-selected Git history and optional Markdown task lists to draft work reports, with no evidence of upload, persistence, destructive behavior, or hidden instructions.
Install only if you are comfortable letting the skill read Git commit metadata from directories you provide and, if used, a Markdown plan file. Prefer pointing it at specific project folders rather than broad home or work directories.
The skill advertises very broad trigger phrases such as “周报”, “写周报”, and “本周工作总结”, which can easily overlap with ordinary conversation and unrelated user requests. That can cause accidental invocation of a skill that scans local Git repositories and reads local plan files, increasing the chance of unintended access to sensitive local project metadata even if everything stays on-device.
The skill instructs the agent to read local repositories and execute a Python script via shell, but it does not declare any explicit tool scope or permission boundaries. That creates an authorization gap where broad file access and command execution may occur without clear user-visible constraints, increasing the risk of unintended access to sensitive local data or overbroad execution.
The trigger phrases are very broad, including ordinary workplace expressions like '周报' and '月度总结', which can cause the skill to activate in contexts where the user did not intend repository scanning or local file analysis. Because this skill can read Git history and optional plan files, accidental invocation can expose more local context than necessary for a simple writing request.
Automatically selecting language by inspecting commit content uses repository data for a behavioral decision without explicit opt-in. While lower severity than shell or file-scope issues, it still expands data processing beyond what the user may expect and can leak assumptions about private project content or preferred language.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""返回仓库受 Git 管理文件的后缀集合。"""
cmd = ["git", "-C", repo, "ls-files"]
try:
output = subprocess.run(cmd, capture_output=True, text=True,
timeout=GIT_TIMEOUT_SECONDS).stdout
except (subprocess.TimeoutExpired, OSError):
return []
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if author:
cmd += ["--author", author]
try:
out = subprocess.run(cmd, capture_output=True, text=True,
timeout=GIT_TIMEOUT_SECONDS).stdout.strip()
except (subprocess.TimeoutExpired, OSError):
return []
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if author:
cmd += ["--author", author]
try:
out = subprocess.run(cmd, capture_output=True, text=True,
timeout=GIT_TIMEOUT_SECONDS).stdout.strip()
except (subprocess.TimeoutExpired, OSError):
return []
The language-selection logic returns "zh" when no commit text is present, which imposes a specific locale by default rather than preserving neutrality or requiring explicit user choice. This is a natural-language policy concern because the skill can force Chinese output even when the user did not request that language.