Security audit
Security checks for vulnerabilities and agentic risk
The packaged skill is a local UDI format validator with no evident malicious behavior, though its install instructions and metadata should be read carefully.
Install only from the reviewed package or a pinned, trusted source rather than blindly fetching the latest raw GitHub file. Expect local Python execution and Chinese-first CLI output; do not rely on the tool as legal or regulatory advice without human review against official UDI requirements.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# UDI 格式校验器 / UDI Format Validator
   
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p ~/.claude/skills/udi-format-validator/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/udi-format-validator/scripts/udi_format_validator.py -o ~/.claude/skills/udi-format-validator/scripts/udi_format_validator.py
python ~/.claude/skills/udi-format-validator/scripts/udi_format_validator.py --help
The README instructs users to download executable code directly from a remote URL into a persistent agent skills directory and then run it. This creates a supply-chain and persistence risk: if the remote content changes or the source is compromised, malicious code could be installed and retained across sessions without any integrity verification.
mkdir -p ~/.claude/skills/udi-format-validator/scripts
curl -fsSL https://raw.githubusercontent.com/zhaoxinghua09-cell/agent-skills/main/skills/udi-format-validator/scripts/udi_format_validator.py -o ~/.claude/skills/udi-format-validator/scripts/udi_format_validator.py
python ~/.claude/skills/udi-format-validator/scripts/udi_format_validator.py --help
The skill markets itself as a zero-dependency deterministic local validator, but the manifest/risk text introduces broader capabilities such as API use and file writes. This kind of capability-scope mismatch can mislead reviewers and agents about the actual trust boundary, causing the skill to be approved or invoked under weaker assumptions than its metadata warrants.
The risk rationale says the skill may perform API access, file reads/writes, and local execution, while the rest of the skill presents a simple validator workflow. Contradictory risk documentation weakens security review because operators cannot reliably determine whether the skill is safe for low-trust use or whether stronger approval gates are needed.
The markdown workflow says simply 'Trigger → run the script per usage', but it does not specify what exact phrases, contexts, or conditions should activate the skill. This is vague enough to allow unintended invocation because 'Trigger' is undefined and no exclusions or negative examples are provided.
The file’s natural-language interface is consistently hard-coded in Chinese, including comments, argparse descriptions, error messages, notes, and printed results. Because this is a user-facing CLI and no language/locale choice is offered, it violates the policy against forcing a specific language without user opt-in.
The skill description is primarily presented in Chinese, with only a brief English line, and the sample output is also Chinese. For a general-purpose skill README, this can amount to an implicit language/locale constraint without explicit user opt-in or a documented regional limitation.
The manifest prominently sets the display name in Chinese and the sample output is shown in Chinese, but the document does not state that language selection is optional or user-configurable. This can violate language/locale policy where skills should not force a specific language without user opt-in.
No suspicious patterns detected.