Security audit
Security checks for vulnerabilities and agentic risk
This is a benign contest-submission compliance checker, with some overbroad tool metadata and Chinese-centric documentation to consider.
Install only if you need a UIBC/TH-EVT-001 contest-submission checker. Treat its results as decision support, not final adjudication, and prefer running it with only the minimal local command permission needed for the Python CLI; do not grant WebFetch or write access unless you have a separate reason.
The file title and all instructional content are written in Chinese, presenting the skill guidance in a single language with no opt-in, alternative locale, or justification that the skill is region-specific. This creates a natural-language locale policy concern because the skill appears to enforce one language for operators and maintainers.
The text states '中文文档见 SKILL.md', while the file already mixes English and Chinese and does not offer users an explicit language or locale choice. This creates a natural-language locale constraint that appears imposed rather than optional or justified as region-specific compliance guidance.
The skill’s trigger/usage description is broad enough that an agent may invoke it based on generic terms like '赛事' or '判定器' without strong contextual constraints or validation. This can cause over-triggering, where the skill is selected in unrelated contexts and influences downstream decisions with contest-specific compliance logic, increasing the chance of misuse or incorrect automated handling.
The module docstring and all user-facing descriptions are written exclusively in Chinese, and later errors/warnings are also emitted only in Chinese. This creates a language/locale constraint for users without any opt-in, fallback, or explicit statement that the tool is intentionally limited to a Chinese-language audience or region-specific workflow.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
print(json.dumps(out_list, ensure_ascii=False, indent=2))
sys.exit(0 if allok else 2)
args = {k: getattr(ns, k) for k in argnames}
try:
res, rc = _run(args)
except GateError as e:
The user-facing natural-language content in this file is entirely in Chinese, including the instruction that AI agents should prioritize reading SKILL.md. Under the policy criteria, forcing a specific language without offering a user or agent language choice can be a locale/language policy violation.