Security audit
Security checks for vulnerabilities and agentic risk
This appears to be an image scanning skill, but its activation and capability claims are broader and less consistent than its stated purpose.
Install only if you intend to send selected, non-sensitive images to Quark's scanning service. Do not let this skill activate for general security work, document conversion, or bulk file processing unless the publisher narrows the instructions and provides the referenced execution script clearly. Rotate the API key if exposed and manually clean temporary output images when finished.
The trigger condition says to auto-activate whenever a user needs 'Security'-related tasks, which is far broader than the skill's actual purpose. In an agent ecosystem with read/exec/write permissions, this can cause unintended invocation during sensitive workflows and may route confidential files or prompts into an external image-processing path without user intent.
The description uses broad 'Use when' language covering file processing, document conversion, format conversion, and content extraction without strict constraints. Overbroad routing guidance can make an agent select this skill outside its validated purpose, increasing the risk of processing unintended files or invoking external services on sensitive content.
The description says '支持中文交互' as a default capability, and the document does not indicate that users may choose another language. This can violate language or locale policy when a skill appears to force or assume a specific interaction language without explicit user choice.
The documentation explicitly advertises '批量扫描与导出' with export to JSON/CSV/Markdown, which implies multi-image processing. Later, the same file states '每次调用仅限单张图片，不支持批量处理', directly contradicting that earlier capability claim.
The skill is narrowly scoped to image scanning/enhancement, but later claims it should activate for generic 'Security' tasks. That scope drift can cause the agent to invoke this skill in unrelated sensitive contexts, increasing the chance of unnecessary file handling, command execution, or transmission of user data to an external service.
