Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent kernel security research guide, but it needs review because it directs users to fetch and run powerful fuzzing/build tools without enough isolation or supply-chain safeguards.
Install only if you are comfortable treating this as a kernel research workflow. Run fuzzing, kernel builds, and PoCs inside disposable VMs or isolated lab infrastructure, avoid using privileged accounts or environments with secrets, and pin or verify all downloaded tools and kernel sources before executing them.
SKILL.md:152Unpinned Mutable Dependencies Can Introduce Untrusted Executable Code
SKILL.md:319Kernel Source Is Retrieved over an Unauthenticated Git Transport
The skill includes kernel builds, fuzzing, package installation, PoC generation, and commands that can consume resources, modify files, or crash systems, but it provides no safety warning or isolation guidance. In a kernel-vulnerability-discovery context, omitting those warnings materially increases the chance a user runs destructive or destabilizing steps on a host system instead of a disposable lab environment.
The skill metadata and core instructional content are written in Chinese, while the title is in English, and there is no statement that the skill supports user language choice or is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The manifest frames this skill as methodology for discovering Linux kernel vulnerabilities via fuzzing, auditing, and reporting. While fuzzing itself is in-scope, the documented capability to fetch external repositories and build arbitrary third-party tooling introduces a software acquisition/supply-chain action that is not explicitly justified by the stated purpose of analyzing kernel code.
This markdown file uses Chinese for the title and descriptive text, and the rest of the document continues in the same language without indicating that the skill or reference is region-specific or that alternative language support is available. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The title and introductory text are entirely in Chinese, which imposes a specific language on users. The file does not offer an alternative language, opt-in, or a documented region-specific justification for the locale constraint.
The manifest describes kernel vulnerability discovery techniques, but these lines instruct the user to modify the host environment by installing packages. That is ancillary environment management rather than core vulnerability-discovery behavior, and the manifest does not declare setup or system provisioning as part of the skill's scope.
This shell script includes natural-language comments and usage guidance in Chinese, such as the description and dispatch comment, without offering an alternate language or stating that the tool is intended only for a Chinese-speaking environment. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation.
No suspicious patterns detected.