Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent duplicate-file cleanup tool, but it understates the file and command access it needs while offering automatic deletion of local files.
Use the skill only on directories you intentionally select, run report mode first, and keep backups before using --apply. The publisher should correct the permission declarations and command examples before users rely on it for cleanup.
The manifest declares filesystem: false, yet the skill explicitly instructs scanning directories and, with --apply, deleting duplicate files. This mismatch defeats policy-based safety controls because a reviewer or execution platform may classify the skill as non-file-touching when it is in fact designed to read and remove local files.
The manifest claims subprocess: false, but the interface declares a Python CLI entry point and the usage tells the agent to execute python3 dup_finder.py .... This creates a trust-boundary mismatch that can cause the platform or user to underestimate execution risk and allow undeclared code execution behavior.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
### Usage
1. The core script is `dup_finder.py`; run it with a Python interpreter on the PATH.
2. Key parameters: `-r` scans the target folder recursively; `--apply` automatically deletes the extras and keeps the first copy.
3. Example: `python3 dup_finder.py -r -d /path/to/dir --apply`.
### Workflow
The file content is entirely in Chinese and presents the skill documentation/instructions in that language without offering an alternative language or noting that the skill is region- or language-specific. This can violate language/locale policy when users or agents are expected to operate in a different language by default.