Security audit
Security checks for vulnerabilities and agentic risk
This skill is a transparent PKU credential-helper guide that stores credentials in the OS keyring and does not include executable code.
Install this only if you intend to use PKU-related CLI tools with stored credentials. Run the initial credential storage yourself, confirm which PKU service an agent is logging into before allowing auto-login, and use info-auth clear if you no longer want credentials stored in the OS keyring.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
info-auth store
# User enters username + password interactively
# Credentials stored in OS keyring, encrypted
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
info-auth store
# User enters username + password interactively
# Credentials stored in OS keyring, encrypted
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
info-auth store
# User enters username + password interactively
# Credentials stored in OS keyring, encrypted
The skill description contains very broad trigger phrases such as 登录, 凭据, keyring, credential, and auth, and says it is the FIRST skill to use before other PKU services. That can cause the agent to invoke this authentication skill in situations where the user did not explicitly request credential handling, increasing the chance of unnecessary exposure to sensitive auth workflows or prompting around secrets.
The development note mandates that all user-facing strings be in Chinese, which is a language-policy constraint applied unconditionally. The file does not indicate that users can choose their preferred language or that the Chinese-only behavior is an explicit opt-in.