Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a simple local text-statistics tool, but its metadata understates the file and process access it actually needs.
Install only if you are comfortable with a local Python script reading the files or directories you explicitly point it at. The publisher should correct the manifest to disclose filesystem and subprocess use and remove the unnecessary Write tool permission before this is treated as cleanly permissioned.
The manifest declares filesystem: false, yet the skill’s purpose, inputs, and workflow explicitly require reading files and directories and producing output from them. This mismatch can bypass policy gating, causing an agent or reviewer to underestimate the skill’s real access needs and approve execution under incorrect trust assumptions.
The skill allows Bash and instructs operators to run python scripts/text_stats.py, but the manifest states subprocess: false. This creates a deceptive capability declaration: execution of the script necessarily involves process spawning, which can weaken sandboxing decisions and mislead downstream automation about the true execution surface.
The English activation guidance says only 'When the user needs text statistics,' which is a very broad condition without clear boundaries on what does or does not invoke the skill. This can overlap with many ordinary requests involving text, code, counting, or analysis and lacks negative examples or scope constraints.
The Chinese sections describe activation as '当用户需要文本统计器相关能力时' and '识别文本统计器相关任务,' which are broad, self-referential conditions rather than specific trigger criteria. The file does not provide negative examples or explicit limits to distinguish this skill from more general text-processing tasks.
The natural-language content in this file is entirely in Chinese, including the instruction that AI agents should read SKILL.md first and the skill summary. For organizational language/locale policy, this can be a violation when the skill effectively constrains usage to one language without any user opt-in or documented regional justification.
The script's natural-language interface is written in Chinese, including the description, help text, and user-facing messages, with no indication that another language can be selected. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
