Security audit
Security checks for vulnerabilities and agentic risk
Review before relying on this guard: it labels some dangerous actions safe and does not itself enforce blocks or approvals.
Treat this as an advisory classifier, not a security boundary. Before relying on it for files, messages, or payments, require an enforcing dispatcher that rejects unknown operations, waits for explicit approval, and records appropriately redacted audits. Independent source review and classification probes confirmed the protection gaps despite the empty static-scan results. Scanner coverage exceptions were investigated; enforcement by any separate host integration remains unverified.
The skill promises interception of every tool call, but its documented executable interface returns a classification and decision rather than establishing a mandatory execution boundary. Without an enforcing integration, confirmation and blocking labels do not prevent execution; presenting this as a complete guard can leave destructive actions, external sends, and payments unprotected.
The classifier initializes every operation to level zero and increases it only when a listed substring matches, so unknown side-effecting operations receive ALLOW. For example, an 'exec' tool with arguments 'unlink x' matches none of the keywords despite describing deletion; if a dispatcher trusts this decision, it can execute a destructive action without confirmation.
Shadow Command Trigger: description clause 'reads pass, writes request confirmation, and deletes, external sends and payments are intercepted before they run' conflicts with built-in command 'run'
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- 「AI 把文件删了能拦一下吗」 / "the agent deleted files by accident"
- 「怎么限制 agent 能调哪些工具」 / "how do I limit which tools an agent can call"
- 「别让 AI 未经确认就发邮件」 / "stop the AI sending email without approval"
- 「给自动化脚本加一道确认闸门」 / "add a confirmation step to my automation script"
- 「agent 调用支付接口前想先卡住」 / "block the agent before it hits the payment API"
- 「工具权限分级怎么设计」 / "how should I tier tool permissions"
These phrases commonly describe ordinary user mistakes, such as deleting a document or sending a message to the wrong person, without involving an AI agent. Listing them independently as activation conditions broadens invocation beyond the skill’s tool-authorization purpose; the generic boundary statement does not clearly exclude these everyday cases.
These explicitly listed trigger words also describe ordinary user mistakes unrelated to AI agents, such as accidentally deleting a personal file or sending a message to the wrong person. Although the surrounding description focuses on agent tool safety, it does not require that context when matching these standalone triggers.