Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a simple contest scoring tool, but its manifest overstates broad tool access and conflicts with its own documentation about whether it runs local code.
Review before installing. The scoring script itself is narrow and transparent, but the package should align its manifest with actual needs: remove WebFetch and Write unless required, make subprocess/file permissions accurate, and resolve whether this is a document-only skill or a CLI skill.
The manifest denies network, filesystem, and subprocess permissions, but simultaneously allows tools that provide those capabilities, including Write, Bash, and WebFetch. This creates a misleading security boundary: operators may approve the skill under a least-privilege assumption while the effective toolset can still read/write files, execute shell commands, and access remote resources.
The operational guidance for the skill is written entirely in Chinese, including the core instructions the AI agent is expected to follow. This imposes a specific language/locale without any stated opt-in, alternative language path, or justification for a region-specific requirement.
The skill manifest advertises a runnable CLI entry point with raw argument passthrough, while the body claims the skill is document-only and has no local script. This inconsistency is dangerous because orchestration systems or reviewers may rely on the safer narrative while runtime infrastructure follows the manifest, enabling unintended execution paths or hiding what actually runs.
The natural-language block hardcodes a China-specific attribution and legal framing ("China", Chinese-language legal/policy wording) as part of the canonical text, while the skill otherwise appears generally usable. Because the file does not explain that this locale constraint is intentional or region-limited, it may conflict with the policy against imposing a specific locale without user opt-in or justification.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
print(json.dumps(out_list, ensure_ascii=False, indent=2))
sys.exit(0 if allok else 2)
args = {k: getattr(ns, k) for k in argnames}
try:
res, rc = _run(args)
except GateError as e:
The file presents all user-facing descriptive text in Chinese and does not mention any language choice, fallback, or opt-in. Under the policy, forcing a specific language or locale without user selection is a natural-language policy concern.