Security audit
Security checks for vulnerabilities and agentic risk
The checker code is local and simple, but the package needs review because its web/write/bash authority, broad activation rules, and stale integrity metadata do not match the stated offline CLI purpose.
Review before installing. The shipped checker itself appears to be a small offline decision-support script, but install it only if you can constrain use to explicit CER equivalence-check tasks and are comfortable with the broader declared tools. Verify the package integrity metadata with the publisher, and treat outputs as regulatory triage rather than legal or official compliance advice.
The manifest description advertises broad trigger phrases without sufficient contextual constraints, making accidental invocation more likely. In combination with the skill's elevated tool permissions, this creates a meaningful misuse risk even if the underlying checker logic is benign.
The read_when conditions are extremely broad, including generic phrases like '医疗器械' and '医械合规', which can trigger the skill in ordinary conversation unrelated to this specific checker. Overbroad auto-activation can cause unintended execution with powerful tools, increasing the chance of inappropriate file access, command execution, or user confusion.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### Process
1. Build a JSON input package with the device registration certificate, comparison data source, and access agreement.
2. Run with `--input` pointing at the data file, or `--demo` for the preset compliant case.
3. The tool parses element completeness, focusing on whether data-access credentials required for clinical evaluation exist.
4. It generates deterministic JSON IR with an immutable analysis log.
5. Use the return code (0/1/2) to judge pass, missing permission, or execution error.
The skill is described as a zero-dependency local CLI checker, yet the manifest grants WebFetch, WebSearch, Write, and Bash. This over-privileging expands the attack surface beyond the documented purpose and can enable unintended network access or filesystem modification if the skill is invoked or repurposed.
The risk rationale states the skill may call APIs, read/write files, and perform local execution, which contradicts the description of a deterministic zero-dependency local checker. Such inconsistencies are dangerous because reviewers and policy gates may underestimate the actual operational permissions and approve a broader capability set than intended.
This code presents its description, CLI help, warnings, notes, and output disclaimer entirely in Chinese, with no opt-in or configurable locale. That can violate language/locale policy where skills must not force a specific language without user choice or documented regional justification.
The natural-language description is entirely in Chinese and does not offer a language or locale choice. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The file title and surrounding instructional content are presented in Chinese as the default operating language for the skill documentation. This can violate a language/locale policy when no user or agent opt-in is provided and no region-specific justification is stated.
This file begins with a policy-style scope notice written in Chinese, while the formal license body is in English, and there is no indication that the Chinese-only explanatory section is optional, translated elsewhere, or required for a specific locale. Under the natural-language policy check, this can be considered a language/locale constraint presented without user opt-in or justification.
This SVG presents all visible product labeling and descriptors in Chinese, with no indication that the skill is region-specific or that users can select another language. The policy allows locale constraints when they are explicitly justified, but this file provides no such justification.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
"rc": 2, "error_code": e.code}, ensure_ascii=False))
sys.exit(0 if ok else 2)
args = {k: getattr(ns, k) for k in names}
if not any(v not in (None, "") for v in args.values()):
p.print_help()
sys.exit(0)
The manifest includes the author name entirely in Chinese script ("注册老炮@MedXpert") with no accompanying locale choice, translation, or justification that this skill is region-specific. For organizational language/locale policy review, this can be read as imposing a specific language context without offering an alternative.
No suspicious patterns detected.