Security audit
Security checks for vulnerabilities and agentic risk
The skill is a plausible IRIS code formatter, but it asks for command and file-changing capability while also mentioning broad triggers, CRUD-style operations, server credentials, and network checks that are wider than a formatter needs.
Install only if you expect the skill to edit files or run local commands for IRIS/ObjectScript work. Keep it away from production IRIS credentials unless you explicitly need live validation, and require review before any command execution, file write, server connection, export, delete, or deployment-related action.
The trigger condition is so broad that it can activate for generic development, debugging, testing, or deployment requests well beyond formatting. In combination with exec/write-enabled tooling, this makes unintended invocation more dangerous because the skill may be selected in contexts where users did not consent to file changes or command execution.
The description states '支持中文交互' and the document is written to position Chinese interaction as the expected mode, but it does not offer the user a language option or explain a necessary locale restriction. This can violate language/locale policy when a skill imposes a specific language without user opt-in.
The skill enables exec and write-capable behavior without prominently warning that it can change files or invoke host commands. For a formatting/checking tool, that mismatch can lead users or orchestrators to treat it as passive analysis while it actually has the capability to alter the system or repository.
The skill is presented as a formatter and basic standards checker, but this section broadens it to create/query/modify/delete, export/save, and runtime configuration operations. That scope expansion increases the chance an agent will perform state-changing actions or handle data beyond the user's expectation, violating least privilege and enabling misuse through ambiguous prompts.
Introducing IRIS server connectivity and credentialed access is unjustified for a Markdown-driven formatter/checker and materially expands the attack surface. It may cause agents or users to provide credentials and connect to live systems for tasks that should be handled offline, increasing risk of unauthorized access or unintended impact on production environments.
The document claims to be pure Markdown with no extra API key, yet later discusses environment-variable secrets and HTTPS communication. This inconsistency can mislead operators about the skill's real privilege and data-handling expectations, causing unsafe deployment assumptions and accidental exposure of credentials.
Guidance to run ping/network diagnostics is outside the justified scope of a code formatter and can prompt unnecessary command execution on the host. While low severity by itself, it normalizes system-level actions unrelated to the task and can be chained with other overbroad behavior to expand host interaction.
No suspicious patterns detected.
