Security audit
Security checks for vulnerabilities and agentic risk
This is an offline AI-output provenance ledger, but it needs review because its metadata says no filesystem/subprocess permission while the documented tool writes persistent local registry files containing provenance data and output summaries.
Install only if you are comfortable with the skill creating a persistent local ledger under registry/. Do not register confidential outputs unless you accept that a short summary, model/version, ownership fields, hashes, and timestamps will be stored in JSONL, CSV, and Markdown. Review the permission metadata mismatch before relying on platform permission declarations.
The manifest explicitly states filesystem: false, yet the skill’s purpose and documented flow require reading and writing a local ledger. This mismatch can mislead policy enforcement, reviewers, or users into granting trust to a skill that actually performs data persistence, undermining sandboxing and permission-based controls.
文件标题及说明全文使用中文，且 L03 直接规定人类读者应优先阅读特定文档，但未说明是否支持其他语言或允许按用户语言偏好切换。根据规则，若技能在自然语言层面强制单一语言而无用户 opt-in，可能构成语言/locale 政策违规。
The trigger description lists many broad, natural-language phrases and governance concepts without clear decision boundaries, which can cause the skill to activate in contexts the user did not intend. In an agent environment, over-broad routing can lead to unnecessary handling of sensitive content provenance, incorrect workflow selection, or surprising side effects such as unwanted record creation and audit logging.
The skill description and usage guidance are written entirely in Chinese, including operational instructions and policy text, with no indication that other languages are supported or that the Chinese-only presentation is intentional and justified for a region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown/manifest file explicitly lists trigger phrases, but one of them is a very short and ambiguous term: "有籍". On its own, it does not clearly constrain invocation to AI output provenance tasks, increasing the chance of unintended activation compared with the more specific phrases listed nearby.
The skill proposes storing provenance, ownership, prompt-hash, model/version, and timestamp data in a local ledger without clearly warning that such metadata may be sensitive or linkable. Even without network access, persistent local storage of attribution and prompt-derived metadata can expose confidential project details, authorship information, or audit trails to unintended local readers.
The documented CLI uses flags like --register and --verify <record_id>, while the declared interface says the entry point accepts a required positional command with values add|verify|lookup|report. Interface inconsistencies can cause wrappers, agents, or human operators to invoke the wrong behavior, bypass validation, or implement unsafe fallback logic around the tool.
The file states in Chinese that this is an AI-readable skill index and the rest of the skill description is presented entirely in Chinese, which indicates a fixed language expectation. There is no indication that users or agents may choose another language or that the locale restriction is optional or justified as region-specific.
This file uses Chinese headers and Chinese summary text throughout, with no indication that the skill or registry is region-specific or that users can choose a language/locale. That creates a natural-language locale policy concern because the content appears to enforce a specific language without user opt-in.
This .jsonl file contains natural-language content in Chinese in the "summary" fields on both lines, with no indication that users can choose language or that the registry is intentionally Chinese-only. Per the policy, forcing a specific language without opt-in is a locale/language policy violation.
This file's natural-language content is entirely Chinese, and there is no indication that users can choose another language or that the registry is intentionally limited to a Chinese-speaking context. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
The add flow persists a user-controlled summary derived from either the provided text or the first 60 characters of a file into JSONL, CSV, and Markdown outputs without consent, minimization, or retention controls. If users register sensitive outputs, this creates a durable secondary copy of potentially confidential data in multiple formats, increasing exposure through local disclosure, backups, or later sharing of the registry artifacts.
Line L20 states the skill is '纯离线零依赖' (purely offline, zero dependency). However, L03 includes a shields.io badge URL and links to GitHub, which causes network access when the README is rendered, contradicting the offline characterization in the documentation.
The timestamp generator hardcodes a +08:00 offset, which imposes a specific locale/timezone behavior regardless of the user's environment. There is no visible opt-in, configurability, or justification that this skill is intended only for a region where that locale is required.
