Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language NSFC grant-writing helper with local checklist scripts, and I found no hidden data access, network execution, persistence, or privilege behavior.
Install only if you want Chinese-language help with NSFC application structure and checklists. Do not paste confidential, unpublished, or regulated research details unless your environment is approved for that data, and verify current NSFC rules and AI-use disclosure requirements against official guidance before submission.
The entire skill description and all example interactions are written as if the skill operates only in Chinese, but there is no statement that this is optional, user-selected, or required for a justified region-specific workflow. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The README states '不代写' and says it only provides guidance, yet earlier sections describe helping users '从零到一完成' the application, '逐步指导各部分撰写', and even '提供优化后的版本参考'. Those statements create a direct intent-level contradiction in the skill's own documentation about whether it merely advises or substantively drafts content.
The README says users can invoke the skill by saying phrases like "帮我看这个摘要", "格式有什么问题", and especially "这个部分怎么写", which are broad, everyday requests without clear boundaries to NSFC grant-writing contexts. Because the document does not define exclusion conditions or constrain activation to a specific environment, these phrases could cause unintended invocation.
The manifest description and top-level skill content are entirely in Chinese and present the skill as a general writing assistant for NSFC applications, but they do not explicitly state that use is limited to Chinese or offer an opt-in language choice. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
This shell script presents all user-facing prompts and status messages in Chinese, which imposes a specific language on users. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
The script's comments, prompts, and output are entirely in Chinese, and accepted affirmative input is tailored to Chinese ('是') plus a partial English fallback ('y'). This imposes a language constraint on all users without opt-in or explanation, which is a natural-language policy concern for locale flexibility.
No suspicious patterns detected.
