Security audit
Security checks for vulnerabilities and agentic risk
The skill is a simple medical-device import/export helper, but it allows broad local and network tools and mentions automatic filings and full logging without clear user approval.
Review before installing. The core CLI appears benign, but only use it as decision support with human verification against official regulations. Do not allow it to submit filings, write records, fetch external sources, or retain full logs unless you explicitly approve the action and have rules for redacting and storing sensitive compliance data.
Line L01 presents the skill handbook entirely as a Chinese-language instruction document for AI agents, and the file does not indicate that other languages are supported or optional. Under the language/locale policy rule, forcing a specific language without opt-in or justification is a natural-language policy concern.
The file presents substantial mandatory Chinese-language content, including the title and large duplicated sections, without stating that the skill is China-specific only or that users may choose their preferred language. This can violate language/locale policy where skills should not impose a specific language absent opt-in or documented justification.
The manifest markets the skill as a zero-dependency decision-support router, yet it is permitted to read files, modify files, execute shell commands, and fetch from the web. That broader capability set creates hidden attack surface and weakens least-privilege expectations, especially for a compliance-oriented skill that users may trust with sensitive business data.
The skill text repeatedly claims there is no need for local scripts or file I/O, but the manifest grants Bash and Write access. This mismatch can mislead users and reviewers about the real execution and persistence surface, increasing the chance that the skill performs local actions the operator did not expect.
The manifest description lists trigger words such as “医疗器械”, “合规”, and “判定器”, which are broad terms likely to appear in ordinary user requests beyond this specific skill. The file does not provide explicit exclusion conditions or negative examples to clarify when the skill should not activate.
The workflow states that the skill may auto-trigger downstream filing steps, but it does not warn users that this could initiate consequential external actions. In a medical-device compliance context, unintended filings or registrations could create legal, regulatory, or operational harm if initiated on incorrect or incomplete inputs.
The Chinese workflow mirrors the English text by recommending automatic triggering of downstream filing actions without a corresponding warning or approval gate. Because the skill is positioned as compliance decision support, users may over-trust the output and accidentally cause real-world regulatory actions based on model-generated determinations.
This code presents its CLI description, argument help, errors, warnings, and JSON string values entirely in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless a justified region-specific constraint is documented, which is not present here.
The file’s user-facing natural language content is entirely in Chinese, including the core description and file guidance, with no indication that other languages are supported or that Chinese is a required locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
The skill’s primary display name and substantial content are Chinese-first, and the trigger phrases and operational descriptions are partially localized to Chinese-specific usage without any stated language selection behavior. While an English section exists, the file does not explicitly state that users may choose their preferred language or that Chinese is required for a justified regional-compliance reason.
The instruction to retain full call logs for auditability omits any warning about handling sensitive commercial, regulatory, or possibly personal data. Full unredacted logging can expose trade details, identifiers, and compliance records beyond what is necessary, increasing privacy and confidentiality risk.
The recommendation to save complete call logs for audit purposes lacks any disclosure of privacy, confidentiality, or data minimization considerations. In this domain, logs may contain sensitive product, trade-route, or regulated-entity information, so indiscriminate retention expands exposure if logs are accessed or leaked.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
print(json.dumps(out_list, ensure_ascii=False, indent=2))
sys.exit(0 if allok else 2)
args = {k: getattr(ns, k) for k in argnames}
try:
res, rc = _run(args)
except GateError as e: