Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a medical-device recall decision helper, but it asks for broader execution, file-writing, and web access than its no-script prompt workflow justifies.
Review before installing. The skill's core purpose is coherent, but install it only if you are comfortable granting broad local command, write, and web access to a prompt-style medical compliance helper; preferably require the publisher to remove or tightly document Bash and Write permissions and constrain WebFetch to official regulatory sources.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# recall-decision-checker · 医疗器械召回级别判定器
[](https://github.com/zhaoxinghua09-cell/lgd-theory)
The skill is presented as a zero-dependency, no-script decision-support checker, yet it declares Bash, Write, and WebFetch permissions that enable command execution, file modification, and outbound network access. This mismatch expands the attack surface and can mislead users or reviewers into trusting a far more privileged skill than its documented purpose requires.
Write permission is broader than needed for a skill whose stated purpose is to produce JSON IR as conversational output. Unnecessary file-writing can be abused to alter local artifacts, leave deceptive outputs, or stage data for later exfiltration or execution.
The documentation explicitly says 'No scripts' / '无脚本', but the manifest still permits Bash execution. This inconsistency can cause operators to underestimate risk during review and deployment, making dangerous capabilities easier to approve and later abuse.
Line L28 states '中文文档见 SKILL.md', indicating the skill's documentation is presented in Chinese as the default without offering an alternative language or user choice. This is a natural-language locale policy concern because it imposes a specific language on users without opt-in or justification as a region-specific requirement.
The primary display name is set in Chinese while the file also includes English fields, but there is no statement that users can choose their preferred language or locale. This can violate a language/locale policy when a skill presents a fixed language by default without explicit opt-in.
Write permission is broader than needed for a skill whose stated purpose is to produce JSON IR as conversational output. Unnecessary file-writing can be abused to alter local artifacts, leave deceptive outputs, or stage data for later exfiltration or execution.
WebFetch introduces outbound network access despite the skill being described as zero-dependency and rules-based. Even if intended for official-source lookups, undocumented network access increases data exposure risk and weakens the claim that determinations are self-contained.