Security audit
Security checks for vulnerabilities and agentic risk
This Chinese blog-writing skill has disclosed local draft, export, search, and reference-library behavior that fits its stated writing purpose, with some user-control caveats.
Install this if you want a Chinese-language writing workflow that saves local Markdown drafts. Choose BLOG_REFERENCES_DIR narrowly, expect the agent to read recent .md files from that directory for style, approve any web research on sensitive topics, and check generated export files before cleanup or archiving.
The skill is presented as a writing assistant, but its documented behavior also includes local file persistence, archival copying, deletion of generated files, environment-variable-driven directory access, and shell-based export via pandoc. That mismatch is dangerous because users may invoke a seemingly harmless writing skill without realizing it can modify the local filesystem and execute external programs.
The trigger guidance says to prefer activation even when uncertain, which encourages overbroad invocation. In context, that is risky because activating this skill can lead to file writes, file reads, web searches, archiving, and shell-based export operations outside a narrowly confirmed user intent.
The skill instructs the agent to read and write local files and invoke shell commands, but it does not declare any explicit tool scope or permission boundaries. This increases the chance of unintended filesystem or command execution behavior because a caller cannot tell, up front, what capabilities the skill expects to use.
The skill name and description specify writing in Chinese, and the overview reiterates that the skill helps produce Chinese articles. The file does not present this as an explicit user opt-in language choice or explain a necessary locale restriction, which conflicts with the policy against forcing a language without user choice.
The skill directs the agent to automatically write drafts to local storage as part of normal operation, but it does not foreground this as a side effect requiring explicit user consent. Automatic persistence can leak sensitive content, create unwanted files, or overwrite user expectations in what appears to be a normal chat-writing flow.
The archiving step includes deletion of export artifacts from the drafts directory without a strong safety prompt, backup, or confirmation. Any automated deletion is sensitive because users may rely on those files, and mistaken path handling or unexpected naming collisions could cause data loss.
The skill authorizes automatic web searching whenever evidence seems useful, rather than limiting network access to explicit user requests. For a writing skill, this expands data flow and can expose user topics, draft context, or research intent to external services without sufficiently clear consent.
Line L049 explicitly requires '中文书写', which imposes a specific language on outputs. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the constraint is justified or optional, which is not stated here.
This markdown file contains user-facing natural-language instructions exclusively in Chinese, starting from the title and continuing throughout all templates. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy violation when no alternative or justification is provided.
The module docstring, usage text, and printed messages are entirely in Chinese and identify the skill as "blog-writer-zh", which effectively imposes a specific language/locale on users. The file does not indicate that language selection is optional or that the locale restriction is required for a region-specific compliance purpose.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print(" https://pandoc.org/installing.html (其他)")
return False
try:
subprocess.run(
["pandoc", str(md_path), "-o", str(docx_path), "--from", "markdown", "--to", "docx"],
check=True,
capture_output=True,
No suspicious patterns detected.