Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Quark subtitle batch workflow, but users should treat the Quark cookie and cloud-drive changes carefully.
Before installing, confirm you trust the existing quark_subtitle_tool because this skill tells the agent to run its scripts against your Quark account. Store the Quark cookie securely, do not paste or print it, and review batch results before accepting uploads or rollback deletes.
The skill instructs filesystem-dependent operations and references specific local paths and report files, but it does not declare an explicit tool scope such as allowed file-read permissions. In an agent setting, missing scope declarations can cause overbroad file access or make reviewers unable to verify the minimum necessary privileges, increasing the chance of unintended data exposure.
The skill requires a valid Quark cookie in a user config file but provides no handling guidance for this sensitive credential. Without warnings or safeguards, users or agents may expose the cookie in logs, prompts, shell history, screenshots, or reports, enabling account takeover or unauthorized cloud storage access.
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
from pathlib import Path
# Optional env override: QUARK_WORK_DIR=/path/to/quark_subtitle_tool/quark_work
ROOT = Path(__import__('os').environ.get('QUARK_WORK_DIR', 'quark_subtitle_tool/quark_work')).expanduser().resolve()
def load(p):
L40-L41 define subtitle preferences with a default of bilingual zh+en and discuss Chinese-only fallback, which imposes a locale/language preference in the skill description. Because the document does not clearly state that users may choose other language preferences, this may violate the language-choice policy.
No suspicious patterns detected.