Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple CET-4 vocabulary helper that reads a bundled word list and does not show hidden, destructive, network, credential, or persistence behavior.
Reasonable to install if you want a Chinese-language CET-4 vocabulary helper. Be aware it declares shell availability even though its visible behavior only needs to read the bundled word list; prefer a future version that documents a maximum word count and narrows or explains that shell requirement.
The skill requests shell access even though its stated function is only to read random entries from a local vocabulary file. Unnecessary execution capabilities violate least privilege and expand the attack surface, enabling file access or command execution beyond what users would reasonably expect from a simple vocabulary skill.
The natural-language instructions require returning Chinese-labeled output and Chinese translations, but do not offer the user any language or locale choice. This is a language policy concern because the skill appears to enforce a specific output language by default rather than allowing user preference.
The invocation instructions say to extract a user-requested number N and randomly read N items, but they do not define clear trigger boundaries, validation rules, or limits. Ambiguous activation and unbounded parameter handling can cause the skill to run unexpectedly or process excessive requests, which is risky when combined with shell-backed local file access.
Suspicious Unicode normalization or mixed-script content
This plain-text vocabulary file consistently presents definitions and example translations in Chinese only, which imposes a specific language/locale across the entire skill content. The file does not indicate that Chinese is optional, user-selected, or justified as a region-specific resource.
No suspicious patterns detected.
