Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a benign vehicle automation-level checker, but its manifest overstates tool access and contradicts its own offline/no-executable claims.
Review this before installing because the declared tool permissions are broader and less consistent than the skill's simple offline classifier needs. If you use it, prefer running the Python script directly with explicit arguments, do not grant network/write/shell authority unless separately justified, and manually verify the GB/T 40429-2021 rule mapping before relying on its output for compliance decisions.
The manifest claims no network, filesystem, or subprocess permissions, but the allowed tool list grants WebFetch, Write, and Bash, which directly enable those actions. Such contradictory declarations can bypass human or automated risk assessment and enable data exfiltration, local file tampering, or command execution under false assurances of isolation.
The documentation explicitly states 'no executable script,' yet the manifest declares a CLI entry point aut-grade-checker.py. That contradiction creates a trust-boundary problem: reviewers may treat the skill as inert documentation while the runtime may execute code, enabling hidden or unexpected behavior.
The file is written entirely in Chinese and presents itself as the agent-facing instruction manual, while directing human readers elsewhere. This creates a locale/language constraint for AI agents and maintainers without any opt-in, alternative language path, or justification that the skill is region-specific.
Line L090 states '中文文档见 SKILL.md', indicating the documentation is provided in Chinese for users, while the file does not offer an explicit language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The skill presents itself as an offline, zero-dependency, doc-style decision tool, but its manifest simultaneously exposes powerful execution-capable tools such as Bash, Write, and WebFetch. This mismatch can mislead operators, policy engines, or users into trusting the skill as non-executing while it actually has capabilities to run commands, modify files, or access external resources.
The manifest-style description explicitly lists trigger words, and one of them is the very broad term "合规". Because this word is common across many compliance-related conversations, it could cause unintended invocation outside the narrow TH-AUT-001 vehicle automation-level use case.
The changelog states "English first," and the document begins with an English section before Chinese, indicating a fixed language/locale preference. This is a natural-language policy concern because the skill does not offer the user a language choice or make the language preference opt-in.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
print(json.dumps(out_list, ensure_ascii=False, indent=2))
sys.exit(0 if allok else 2)
args = {k: getattr(ns, k) for k in argnames}
try:
res, rc = _run(args)
except GateError as e:
The natural-language content of the file is entirely in Chinese, including the instruction that AI agents should prioritize reading SKILL.md. This may violate a language/locale policy when no user or agent language choice is offered and no region-specific justification is documented.