Security audit
Security checks for vulnerabilities and agentic risk
This looks like a legitimate compliance helper, but its manifest grants broad file, web, and shell tool access that conflicts with its stated no-permission design.
Install only if you are comfortable reviewing and limiting the declared tool access. The Python script itself appears narrow and local, but the skill manifest should be corrected to remove unnecessary Write, WebFetch, and broad shell/file permissions or clearly justify them. Users should also avoid entering personal identifiers or raw sensitive genetic-resource records unless their organization permits that handling.
The manifest claims network: false, filesystem: false, and subprocess: false, yet allowed-tools includes Read, Glob, Grep, Write, WebFetch, and Bash, which collectively enable file access, network access, and shell execution. This mismatch can mislead reviewers and policy engines into underestimating the skill’s effective privileges, creating a privilege-escalation-by-declaration problem.
This file contains operational instructions for AI agents exclusively in Chinese, including the title, purpose, and behavioral rules. That can constitute a language/locale policy issue because it forces a specific language for use of the skill without documenting user choice, opt-in, or a justified regional limitation.
The skill is described as a zero-dependency, built-in-rule decision tool, but its manifest exposes web access, shell execution, and file-modification capabilities that are not aligned with that description. Even if unused in normal operation, these capabilities expand the attack surface and permit data exfiltration, arbitrary command execution, or unauthorized file changes if the skill is invoked or adapted unsafely.
The trigger terms include broad words like compliance and classifier-related labels that can cause the skill to activate in loosely related contexts. Over-broad invocation is risky here because the skill handles regulated human genetic resource scenarios and also exposes more capability than its description suggests, increasing the chance of accidental use with sensitive inputs.
The documentation instructs users to submit project details including sample type, collection purpose, and institution qualification, but it does not warn against including sensitive, personal, or regulated biological information beyond what is strictly necessary. In a human-genetic-resource compliance context, omission of data-handling warnings increases the risk of overcollection, inappropriate disclosure, or noncompliant processing of sensitive information.
The module docstring and user-facing descriptions are entirely in Chinese and present the tool as operating in that language, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.
User-facing argument help strings and validation errors are written only in Chinese, which effectively constrains interaction to one language. The file does not provide an explicit language selection mechanism or justification for the locale restriction.
The document is explicitly bilingual in Chinese and English and does not state that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.
The README first states that the code file hgrac-route-checker.py is licensed under MIT, but later says the package has no LICENSE file and that the code license is pending. These statements actively conflict and create intent/documentation divergence about whether the code is actually MIT-licensed.
The changelog explicitly states "English first," and the document is structured with the English section presented first, without any statement that the user may choose their preferred language. This can be read as a locale/language preference being imposed rather than offered as an option.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
print(json.dumps(out_list, ensure_ascii=False, indent=2))
sys.exit(0 if allok else 2)
args = {k: getattr(ns, k) for k in argnames}
try:
res, rc = _run(args)
except GateError as e: