Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a simple medical-device label checklist tool, but it asks for shell, file-write, and web access that its own instructions do not clearly justify.
Install only if you are comfortable granting a label-checking skill local shell, file-write, and web-fetch capabilities. Prefer constraining it to the bundled Python checker and label inputs, avoid letting it fetch rules or write files automatically unless you explicitly request that, and treat all compliance output as decision support that requires human verification against official sources.
The file’s operational instructions for agents are entirely in Chinese, including core usage and behavioral guidance. This can impose a language policy constraint on users or maintainers without any opt-in, alternative language option, or stated region-specific justification.
The skill is presented as zero-dependency and based on built-in official rule sources, but it is granted shell and network tooling that exceeds that stated scope. That discrepancy increases the risk that an orchestrator or agent may invoke unnecessary privileged capabilities, enabling data exfiltration, unreviewed external fetches, or local command execution contrary to user expectations.
The skill text says it is a document-style tool with no external script execution, yet the manifest permits both Bash and WebFetch. This mismatch can mislead users or upstream agents into trusting the skill as non-executing while it still has the capability to run shell commands and access the network, expanding the attack surface for prompt-injection or unintended tool use.
The manifest description says to use the skill 'when medical device label compliance checker capability is needed' and lists trigger words like '医疗器械' and '合规', which are broad terms that can occur in many ordinary discussions. It does not clearly delimit activation boundaries or provide exclusion examples, increasing the risk of unintended invocation.
Natural-language policy violations apply to all file types, including code string literals and comments. Here, the user-facing description, argument help, and runtime messages are all Chinese-only, which effectively forces a specific language without user opt-in or an explicit documented justification that the tool is region- or locale-locked.
This file hardcodes the documentation and usage guidance to two specific languages, which can create a language/locale access constraint for users who do not read English or Chinese. The policy exception does not clearly apply here because the README does not explicitly offer a language choice mechanism or justify the locale restriction as required for a region-specific audience.
The primary display fields and title are set only in Chinese, and the operational sections are presented bilingually but do not state that language should follow user preference. This can create a locale policy issue if the skill defaults to Chinese presentation for users who did not opt in.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
out_list.append({"tool": META["slug"], "input": d, "errors": [str(e)], "rc": 2, "aigc_mark": AIGC})
print(json.dumps(out_list, ensure_ascii=False, indent=2))
sys.exit(0 if allok else 2)
args = {k: getattr(ns, k) for k in argnames}
try:
res, rc = _run(args)
except GateError as e: