Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Ubuntu kernel CVE lookup aid that uses public Ubuntu security sources and only shows limited, read-only local inspection commands.
Installers should know the skill appears Chinese-language oriented and may fetch public Ubuntu security pages or OVAL data. The local commands shown are read-only, but users should still review outputs before sharing system version or package information externally.
The manifest description and the entire skill documentation are written in Chinese, and there is no indication that the skill supports other languages or lets the user opt in to Chinese output. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale limitation is explicitly documented and justified.
The manifest describes this skill as tracking Ubuntu kernel CVEs via Ubuntu Security sources, including querying CVE lists, USN details, discovery methods, and status matrices. The '快速命令' section adds host-inspection capabilities such as uname -r and dpkg -l, which inspect the local machine rather than Ubuntu security data and are not necessary to fulfill the stated tracking purpose.
The manifest focuses on querying and analyzing Ubuntu kernel CVE and USN information. Documenting wget to download OVAL data introduces a generic file-download capability; while OVAL is a relevant data source, the documented behavior goes beyond the manifest's user-facing scope of querying and summarizing vulnerability information.
This markdown file is entirely written in Chinese and does not provide an English alternative, locale selection, or any opt-in language choice. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale restriction is clearly documented and justified, which is not present here.
No suspicious patterns detected.
