Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a UDI compliance checker, but it requests shell, file-write, and web access that its own documentation does not clearly need.
Review before installing. The skill's compliance-checking content is coherent, but the publisher should remove or precisely justify Bash, Write, and WebFetch, including what data is read, what files may be written, and when network access occurs. Treat its regulatory output as decision support, not legal advice.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# udi-db-submission-check · UDI 数据库提交合规判定器
[](https://github.com/zhaoxinghua09-cell/lgd-theory)
The title and primary descriptive content are presented in Chinese for a broadly described compliance skill, and the file does not state that the skill is limited to Chinese-speaking users or a China-only deployment context. Under the policy, a language or locale constraint should either be optional for users or explicitly justified.
The skill is described as a zero-dependency, deterministic rule checker, but it declares operational capabilities including Bash, Write, and WebFetch that exceed that stated scope. This increases the attack surface and creates a mismatch that could enable unnecessary command execution, network access, or file modification if the skill is later invoked or extended unsafely.
Write permission is broader than necessary for a tool that primarily returns JSON to stdout, and unnecessary write access can be abused to alter local files, leave artifacts, or overwrite user data. While lower risk than shell or network access, it still violates least privilege and broadens consequences of prompt misuse or implementation mistakes.
Write permission is broader than necessary for a tool that primarily returns JSON to stdout, and unnecessary write access can be abused to alter local files, leave artifacts, or overwrite user data. While lower risk than shell or network access, it still violates least privilege and broadens consequences of prompt misuse or implementation mistakes.
The documentation repeatedly claims zero-dependency and rule-determination-only behavior, while the risk rationale explicitly contemplates API calls, file I/O, and local execution. This inconsistency can mislead reviewers and users about the true trust boundary, causing them to approve or invoke the skill under a weaker threat model than its permissions warrant.
The primary display_name is set in Chinese while English is secondary, and the document presents Chinese branding and a full Chinese section without stating any user language selection behavior. This can conflict with language/locale policy expectations when users have not opted into Chinese as the default presentation language.
Write permission is broader than necessary for a tool that primarily returns JSON to stdout, and unnecessary write access can be abused to alter local files, leave artifacts, or overwrite user data. While lower risk than shell or network access, it still violates least privilege and broadens consequences of prompt misuse or implementation mistakes.
No suspicious patterns detected.