Security audit
Security checks for vulnerabilities and agentic risk
The skill appears purpose-built for prompt version tracking, but it needs review because its security and rollback claims do not match the actual file-writing CLI it ships.
Review this before installing if you plan to use it on shared or production prompts. Treat it as a local diff-and-registry helper only; do not rely on its claimed gate permissions, owner binding, or rollback protections unless those are separately implemented. Use an explicit registry path, keep backups, and require human approval before any rollback or active prompt replacement.
The activation text includes broad user utterances like '提示改乱了回不去' and '不知道哪版提示效果更好', which could overlap with ordinary discussion about prompts rather than a clear request to invoke this specific skill. Although some concrete trigger terms are listed later, the file does not define exclusion conditions or clear scope boundaries for when the skill should not activate.
The description says to use the skill when users say phrases like ‘提示改乱了回不去’ or ‘不知道哪版提示效果更好’, which are broad problem statements rather than narrowly scoped invocation phrases. Because the file does not provide exclusion conditions or negative examples, these triggers could cause unintended activation during normal discussion about prompt issues.
The risk rationale says the skill may call APIs, read/write files, and execute locally, while the declared permissions deny network, filesystem, and subprocess access. This inconsistency undermines trust in the security boundary and can lead reviewers or runtime policy engines to misclassify the skill's actual capabilities, which is dangerous in systems that rely on manifest accuracy for sandboxing or approval.
The manifest and prose describe rollback, version IDs, owner binding, and gate-enforced restoration of system configuration, but the declared interface only exposes old/new text, optional score, registry, and json. This mismatch can cause callers or orchestration layers to assume authorization and rollback protections exist when they are not actually represented or enforceable at the interface level, creating unsafe automation and misleading security expectations.
The skill describes rollback behavior that restores configuration without a prominent user warning about side effects, such as replacing active prompt state or reverting team changes. Even in documentation form, presenting rollback as a routine action without explicit confirmation requirements can normalize potentially disruptive operations and increase the chance of unsafe use in downstream implementations.
The skill advertises invocation using broad, natural-language phrases such as common user complaints and general requests about prompt management. This can cause the agent to activate the skill in situations where the user did not explicitly intend to use it, increasing the chance of unintended workflow execution, context leakage into the skill, or inappropriate steering of the conversation.
Natural-language text in the docstring, error messages, and output is exclusively Chinese, and the script provides no option for users to select another language or indication that the tool is intentionally locale-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
"added": [l for l in diff if l.startswith("+") and not l.startswith("+++")],
"removed": [l for l in diff if l.startswith("-") and not l.startswith("---")],
})
reg_path.write_text(json.dumps(reg, ensure_ascii=False, indent=2), encoding="utf-8")
if a.json:
print(json.dumps({"version": ver, "score": a.score, "diff_lines": len(diff)}, ensure_ascii=False, indent=2))
else:
The document is structured as mandatory English and Chinese sections, presenting the skill in fixed languages rather than offering a user-selectable language or documenting a justified locale constraint. Under the policy criteria, forcing a specific language or locale without opt-in can be a natural-language policy violation.
This code performs a file write to the path provided by --registry, which can modify existing data, but there is no confirmation prompt, warning comment/docstring about overwriting, or other user disclosure immediately associated with the operation. While the script prints after writing, that does not warn the user before the safety-relevant action occurs.