Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Markdown formatting helper, but it asks for broad file mutation and command execution authority while its scope and network/offline promises are inconsistent.
Install only if you are comfortable with an agent reading and rewriting selected Markdown/text files and potentially running local commands. Prefer using an explicit output file, keep backups, avoid sensitive documents, and do not provide callback URLs unless the publisher clarifies network behavior and payload contents.
The skill name and all user-facing instructions are presented only in Chinese, and the document does not state that language is configurable or user-selected. This can constitute a locale or language policy issue if the skill is expected to support users without forcing a specific language by default.
The skill requests exec alongside read and write for a document-formatting use case, which violates least-privilege and creates unnecessary command-execution risk. If an agent maps natural-language file requests into shell commands, an attacker could abuse formatting prompts, filenames, or related parameters to trigger unintended local command execution.
The documentation promises not to add, delete, or rewrite content, yet other sections instruct the tool to generate titles, summaries, descriptions, and structural additions. This mismatch can cause users or calling agents to trust the tool with sensitive files under false assumptions, leading to unauthorized content transformation or accidental publication of generated metadata.
The natural-language invocation guidance is vague, so an agent may overgeneralize and infer permission to act on loosely related prompts. In a skill with filesystem access, ambiguous invocation increases the risk of unintended processing, wrong-file selection, or activating risky modes without sufficient user intent.
The skill claims offline/local-only operation while accepting a callback_url, creating a misleading trust boundary and a potential exfiltration path. In practice, asynchronous callbacks can send document metadata or content to external endpoints, contradicting user expectations that no network communication occurs.
The skill explicitly supports directly modifying the original file but does not prominently warn about overwrite or data-loss risk. In an automated agent workflow, users may not realize that formatting can be destructive, especially when combined with generated frontmatter or structural edits.
The trigger condition is broad enough to activate on many ordinary document-related requests, increasing the chance the skill is invoked outside its intended scope. Overbroad routing is dangerous here because the skill has file read/write and possible execution capability, so accidental invocation can lead to unintended file modifications or processing of unrelated documents.
The example command normalizes in-place modification without any caution, which can lead users or agents to adopt destructive behavior by default. Because the tool may add metadata and reformat structure, in-place edits can irreversibly alter source notes or published content.
No suspicious patterns detected.
