Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly does what it says, but needs Review because its text-only editing workflow can save and apply raw HTML that may become executable code in the edited page.
Install only if you are comfortable reviewing the exported JSON and the resulting HTML before deployment. Use dry runs and backups, avoid sending confidential report content to an external AI, and do not apply JSON diffs from untrusted sources unless the new content has been checked for markup or scripts.
scripts/apply_edits.py:39Unsanitized HTML Editing and Backfill Enables Stored Cross-Site Scripting
The skill clearly instructs use of scripts that read and modify local files, but the manifest does not declare any tool scope or allowed-tools restrictions. That creates a permission-boundary ambiguity: an agent may invoke file read/write capabilities more broadly than a reviewer or orchestrator expects, increasing the chance of unintended file modification or misuse if the skill is activated in the wrong context.
The description contains many broad natural-language trigger phrases like 'make this HTML editable' and 'edit the text myself,' which can cause the skill to auto-match in loosely related situations. Over-broad activation is risky here because the skill performs file transformation and write-back operations, so accidental selection could lead to unnecessary modification of source HTML or confusion about which editing workflow should be used.
The injected editor UI labels and status text are primarily presented in Chinese, and the exported file name and instructions also assume Chinese-language use. This creates a locale/language constraint without user opt-in or a documented region-specific justification, which matches the language-policy violation criteria.
The exported workflow explicitly tells users to send a JSON bundle containing both original and modified HTML fragments to an AI. Those fragments can include sensitive business content, embedded identifiers, internal links, or other confidential text from the source page, creating a data exfiltration/privacy risk when shared with external AI systems. In this skill context, the feature is designed specifically to capture page content and hand it to an AI, which makes the exposure pathway more realistic rather than incidental.
No suspicious patterns detected.