Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Wake-on-LAN helper that sends local network wake packets, can ping configured devices, and stores a small device list on disk.
Install this only if you want your agent to send Wake-on-LAN packets on your local network, ping configured device IPs when --wait is used, and keep MAC/IP device mappings in references/devices.json. Review that file before use and avoid adding devices you would not want the agent to wake.
The skill documentation indicates capabilities that involve shell execution plus reading and writing local files, but it does not declare any explicit tool scope or permission boundaries. That creates an unnecessary trust gap: an agent may invoke broader-than-expected actions such as modifying device configuration files or running network commands without clear authorization constraints.
The trigger description is broad enough to activate on common phrases like 'turn on remote PC' or any mention of WOL/MAC addresses, which increases the chance of the skill being invoked in ambiguous contexts. In an agent environment, accidental invocation can lead to unintended network activity, file modification of saved device mappings, or shell/script execution without the user explicitly requesting this skill.
The manifest describes a skill for sending Wake-on-LAN magic packets to wake remote devices. In addition to that core behavior, the code reads and writes a persistent device inventory in references/devices.json, enabling local state management that is not mentioned in the skill description.
The manifest scopes the skill to sending WOL magic packets, but the code also performs active network reachability checks by invoking the system ping command and polling for device startup. This adds host discovery/monitoring capability beyond simply transmitting a magic packet.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""
try:
# Use ping command with 1 count and timeout
result = subprocess.run(
["ping", "-c", "1", "-W", str(int(timeout)), ip],
capture_output=True,
timeout=timeout + 1,
This code emits several user-facing status and result messages exclusively in Chinese, such as the wait-progress and success/failure outputs. The file provides no language selection, opt-in, or documented locale justification, which makes the skill impose a specific language on users.
No suspicious patterns detected.