Security audit
Security checks for vulnerabilities and agentic risk
This is a mostly coherent local character-management skill, but it gives broad file read, overwrite, and deletion authority without enforcing project boundaries.
Install only if you are comfortable with a local CLI that can read YAML recursively from any directory you pass and can overwrite or delete files at paths you provide. Use it in a dedicated novel workspace, avoid absolute paths to sensitive locations, avoid --force unless you have checked the exact target file, and prefer a virtual environment with reviewed pinned dependencies.
scripts/manage_characters.py:348Unrestricted Paths Permit Arbitrary File Overwrite, Recursive Read, and Deletion
requirements.txt:1Unpinned Dependencies Make Installations Non-Reproducible
The code broadly matches the stated domain and primary purpose: it is a local character manager for fiction projects that reads/writes YAML character files and supports create, list, query, update, delete, and export. It does not show malicious or unrelated behavior. However, the description claims support for role relationship networks, emotional arcs, and motivation tracking as core capabilities. In practice, motivation is partially supported, relationships are only minimally represented and displayed, and emotional arcs are present only in the schema without effective CLI management. Additionally, the script advertises validate and visualize-relations capabilities but never dispatches them in main(), so those features are effectively not implemented. This makes the declared description materially more capable than the actual behavior.
The skill documents file read/write behavior through --project and --output but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, this weakens least-privilege controls and increases the chance that the skill can be invoked with filesystem access broader than intended, especially since the documentation itself admits arbitrary directory paths can be supplied.
This code file performs a destructive operation by deleting a file, and the --force path explicitly bypasses the interactive confirmation. While normal deletion prompts the user, there is no additional user-facing warning, log emphasis, or docstring/comment disclosure that --force will irreversibly remove the target file immediately.
The --format argument explicitly documents markdown, json, and yaml as valid export formats, but the only export implementation is export_to_markdown, and the dispatch always calls that function regardless of the selected format. This is an active contradiction between the CLI documentation/interface and the code's actual behavior.
The module documentation and argument parser present this tool as supporting validate and visualize-relations operations, which align with the manifest's promises around relationship networks and tracking character growth. However, the command-dispatch logic only handles create/list/query/update/delete/export; there is no implementation for the advertised validation or visualization paths, so the actual behavior falls short of the described capabilities.
The file uses Chinese-only natural-language values for the character name and role, which can imply a fixed language/locale presentation without offering user choice. Under the policy rule, locale-specific content should either provide opt-in or be clearly justified as region-specific.
This manifest-style YAML file uses natural-language descriptions and labels exclusively in Chinese across the entire configuration. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no alternative language choice or justification is provided.
该 markdown 文件全文以中文撰写，且未说明这是面向特定中文用户群体的区域化文档，也未提供语言选择或用户自愿采用中文的机制。根据规则，若技能在自然语言层面强制特定语言而没有用户 opt-in，可视为语言/区域策略违规。
The dependency is specified with a lower-bound only (pyyaml>=6.0.1), which makes builds non-reproducible and allows future installs to resolve to different versions over time. This increases supply-chain risk and makes it harder to verify whether a deployed version includes security fixes or newly introduced issues, especially for a package with a history of deserialization-related advisories.
pyyaml>=6.0.1
rich>=13.7.0
PyYAML has multiple historical security advisories, and because the manifest does not pin an exact version, it is not possible to verify whether deployed environments will receive a fixed or affected release. In a character-management skill that may plausibly import or export structured character data, YAML parsing could become dangerous if untrusted content is ever accepted and unsafe loaders are used.
The rich dependency is also unpinned (rich>=13.7.0), so installations may resolve to different versions in different environments. While this is primarily a supply-chain hygiene issue rather than an immediate exploit path, it weakens reproducibility and can introduce unexpected vulnerable or breaking releases later.
pyyaml>=6.0.1
rich>=13.7.0
Natural-language strings in the module description and CLI help are written exclusively in Chinese, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
No suspicious patterns detected.