Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese academic paper explainer with minor scoping and temporary image-handling caveats, but no evidence of hidden or malicious behavior.
Before installing, be aware that the skill may trigger on broad "help me understand" requests and may copy paper images into a temporary folder during image analysis. Use it with papers and images you intend to share with the agent, and prefer explicit, user-provided folders.
The activation conditions are overly broad, especially the catch-all phrase "帮我理解 xxx", which can cause the skill to trigger on many unrelated requests. Overbroad triggers increase the chance of unintended invocation, context hijacking, or accidental processing of sensitive user content under the wrong skill behavior.
The skill instructs copying user-provided image files into a temporary directory using filesystem operations, but gives no user-facing notice, consent step, or safety constraints on paths and file handling. This can create unintended local file side effects, increase exposure of sensitive document images, and encourage unsafe handling of untrusted file paths or oversized inputs.
No suspicious patterns detected.
