Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a small local SVG badge generator, but its manifest and agent-facing docs understate file-writing behavior and misdescribe the tool’s output, so it should be reviewed before installation.
Install only if you are comfortable with a CLI that creates or overwrites a local SVG file. Treat the filesystem permission and output-contract metadata as inaccurate, keep --out pointed at an intended project path, and avoid using untrusted text in labels, icons, colors, or scores unless the SVG is sanitized before publishing or embedding.
The manifest declares filesystem: false, yet the interface and usage instruct the script to write badge.svg or a user-specified --out path. In permission-gated systems this is a capability declaration mismatch: the skill may perform file writes despite stating it does not need filesystem access, which can bypass review assumptions or cause unsafe execution in constrained environments.
The skill’s safety boundary says it is 'static analysis only' and 'does not delete / modify / publish anything,' but the documented workflow explicitly writes an SVG file to disk. This mismatch can mislead callers, policy engines, or reviewers into granting trust under false assumptions, increasing the chance of unintended file writes in environments that rely on the manifest and safety statements.
The manifest description lists trigger words including "badge", "studio", and "VERIFIED" without constraining context or giving exclusion examples. These terms are generic enough to overlap with ordinary conversation or unrelated workflows, making unintended invocation more likely.
The output schema says stdout contains JSON findings and overall conclusions, but the skill is actually a badge generator producing SVG/file output. This contract mismatch can cause integrating agents to parse output incorrectly, trust nonexistent safety checks, or route the tool into workflows meant for analysis rather than content generation.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Gated | Minimal privilege, fail-closed exit codes, dangerous ops denied by default |
### Safety boundary
- Static analysis only; never auto-executes external commands.
- On risk detection → FAIL (fail-closed); human decides.
- Does not delete / modify / publish anything on the user's behalf.
The primary description is presented in both English and Chinese together, and the changelog emphasizes a bilingual rewrite, but there is no indication that language choice is user-selectable or opt-in. This can violate language/locale policy where skills should not impose a language preference without explicit user choice or documented justification.
No suspicious patterns detected.