Security audit
Security checks for vulnerabilities and agentic risk
This is a local AI-decision logging utility with documentation and manifest mismatches, but no deceptive, network, credential, or background persistence behavior was found.
Before installing, treat this as a simple local logging helper. Use the script's --help output as authoritative, choose the ledger path deliberately, and avoid logging sensitive evidence unless local storage is acceptable. For production use, the publisher should align the schema and documentation and remove unnecessary broad tool declarations such as WebFetch.
The file is written entirely in Chinese and presents itself as the agent-facing instruction manual, but it does not state that Chinese is optional, configurable, or limited to a justified region-specific context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The English usage section documents CLI flags like --decision-data, --time-stamp, and --generate-report, but the declared interface schema exposes different inputs such as command, decision, model, evidence, reviewer, file, and json. This mismatch can cause operators or calling agents to invoke the skill incorrectly, potentially omitting expected audit fields or generating incomplete records, which undermines governance and compliance assurances.
The Chinese usage documentation repeats and expands behavior that conflicts with the declared interface, describing different flags and execution semantics than the schema above. In a compliance-focused logging skill, such ambiguity is security-relevant because it can lead to failed logging, missing human-review markers, or false assumptions that review coverage is being measured when it is not.
The file’s natural-language content is entirely in Chinese and presents the skill description and instructions in that language without offering any language choice or documenting a justified locale restriction. This can violate language/locale policy when users or agents are not given an opt-in or alternative language.
The changelog explicitly states a 'Bilingual rewrite (full EN+ZH, English first)' and the document then leads with an English section before Chinese. This sets a language preference in the skill's natural-language presentation without indicating that users can choose their preferred language or locale.
