Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent CDA synthetic-data generator whose file-writing behavior is disclosed and aligned with its purpose.
Install this if you want CDA-format synthetic causal datasets. Use a normal project/workspace directory for outputs and review generated filenames before writing, especially if asking for large trajectories or benchmark sets.
This markdown skill explicitly lists activation phrases, but several entries such as '生成仿真数据', '因果图数据', and '物理仿真数据集' are broad enough to match common user requests outside this specific CDA skill context. The trigger list lacks negative examples or scope limits clarifying when these phrases should not invoke the skill.
The skill instructs generating JSON data files into a user-specified directory without any visible safeguards, confirmation step, or path restrictions. In an agentic environment, this can lead to unintended filesystem writes, overwriting existing files, or writing into sensitive locations if a user or prompt manipulates the destination path.
Suspicious Unicode normalization or mixed-script content
This markdown file is in scope for SQP-3, which applies to natural-language policy violations such as forcing a specific language or locale without user opt-in. The document is entirely framed as a mandatory standard for all CDA components and provides no indication that Chinese is optional, configurable, or justified as a region-specific requirement.
Suspicious Unicode normalization or mixed-script content
The document title and introductory metadata are entirely in Chinese, and the file provides no indication that language choice is optional or configurable. Under the policy, forcing a specific language without user opt-in can be a natural-language locale violation unless the constraint is explicitly justified.
This JSON manifest contains a natural-language description entirely in Chinese, with no accompanying indication that the skill is region-specific or that users may choose another language. Under the policy criteria, forcing a specific language without opt-in can be a locale/language policy violation.
