Security audit
Security checks for vulnerabilities and agentic risk
The tool code is a simple local health-claim checker, but its manifest and documentation overstate or contradict the authority it needs.
Install only if you are comfortable with a Chinese-focused first-pass compliance checker and can tolerate inaccurate metadata. The publisher should narrow allowed tools, align permissions with the CLI runtime, and fix the documented command before this is treated as a clean low-risk skill.
This file presents the skill instructions entirely in Chinese, including operational guidance for AI agents and maintainers. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or documented justification.
The top-level description is written in Chinese and presents the skill in that locale by default, while the file does not state that language selection is user-controlled. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy concern.
display_name is Chinese while English is secondary via display_name_en, indicating a default locale preference. The file does not explain that this is region-specific or that users can opt into another language, which can violate language/locale policy expectations.
The risk rationale mentions API calls, file read/write, and local execution, while the rest of the manifest presents the skill as zero-dependency with no network/filesystem/subprocess permissions. These conflicting declarations undermine risk classification and can lead operators to approve or deploy the skill under incorrect assumptions.
The skill declares subprocess: false, yet its interface is explicitly a CLI entry point run as python3 with command-line arguments. That contradiction can cause security controls or reviewers to underestimate execution capability, creating a policy-bypass risk through inaccurate manifesting.
The manifest declares filesystem: false, but the documented interface says --input can be a file path and explicitly requires the local script to be readable. This permission mismatch can mislead a caller or policy engine about what the skill actually needs, weakening sandboxing and trust decisions even if the tool's purpose is otherwise benign.
The script’s user-facing description, help text, output messages, and compliance checks are all fixed in Chinese, including the required warning phrase and banned-term list. This enforces a specific language/locale behavior without any opt-in or documented justification, which matches the policy-violation category for language or locale constraints.
