Security audit
Security checks for vulnerabilities and agentic risk
This is a low-risk educational simulation skill for sparse/asynchronous AI architecture patterns, with some overclaimed performance language but no hidden or dangerous behavior found.
This skill is suitable as an educational/demo aid, not as proof of real energy savings or model-level sparse activation. Before installing, expect mostly Chinese documentation, broad activation wording, and local demo scripts that may write a resource_usage.json file when run.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
✅ 无硬编码路径
✅ 无系统调用 (subprocess/os.system)
✅ 无危险操作 (rm -rf/del)
✅ 代码安全，可以发布
A skill that claims to provide neural sparse processing but instead reads directory contents, inspects package structure, or generates publication guidance has undeclared behavior outside its stated purpose. This is dangerous because users may invoke it in trusted contexts expecting architecture assistance, while the actual behavior broadens access to local metadata and project structure without clear consent.
A skill that claims to provide neural sparse processing but instead reads directory contents, inspects package structure, or generates publication guidance has undeclared behavior outside its stated purpose. This is dangerous because users may invoke it in trusted contexts expecting architecture assistance, while the actual behavior broadens access to local metadata and project structure without clear consent.
A skill that claims to provide neural sparse processing but instead reads directory contents, inspects package structure, or generates publication guidance has undeclared behavior outside its stated purpose. This is dangerous because users may invoke it in trusted contexts expecting architecture assistance, while the actual behavior broadens access to local metadata and project structure without clear consent.
The file is written entirely in Chinese and begins with a Chinese title, with no indication that the skill is region-specific or that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
The document presents the skill title and primary descriptive content in Chinese, with only a secondary English subtitle. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly documented and justified, which is not present here.
Without declared permissions the skill's intent is opaque and cannot be validated.
The manifest says to use the skill when asked to "optimize AI architecture," "reduce compute cost," or "design efficient multi-task systems," which are broad requests that could apply to many unrelated skills. It does not provide tighter trigger phrases, scope boundaries, or exclusion examples clarifying when NSAP should versus should not activate.
The module docstring and user-facing prints describe the script as a resource monitor that tracks efficiency gains and compares modular versus traditional processing. In practice, the code fabricates a fixed example scenario with hard-coded module activations and timings, so it demonstrates a hypothetical comparison rather than monitoring real resource usage.
The script advertises a sparse-activation policy with a <5% activation principle, but the CLI-generated module objects all receive priority=1, and activate_sparse unconditionally activates modules with priority <= 2. As a result, any modules supplied through the intended interface are all activated, defeating the stated resource-limiting behavior and potentially causing higher-than-expected compute usage or unsafe architectural assumptions by downstream users.
This Python file contains natural-language docstrings and all user-facing console messages in Chinese, starting with the module description and continuing throughout execution. The policy explicitly disallows forcing a specific language without user opt-in, and the script provides no mechanism to choose locale or language.
The document mixes Chinese and English instructional content as part of the skill description, but it does not state that language should be selected based on user preference. This can conflict with language/locale policies when a skill implicitly forces or assumes a language without opt-in.
This markdown file uses Chinese throughout for headings, instructions, results, and release guidance, but does not indicate that the skill is region-specific or provide any user opt-in for language selection. Under the policy, forcing a specific language without documented justification is a natural-language policy concern.
The skill metadata presents the skill name and description primarily in Chinese in the skill block, with no indication that users can choose a preferred language or locale. This can violate language/locale policy expectations when a skill imposes a specific language presentation without user opt-in.
The task decomposition logic only activates behavior when the input contains English terms like "analyze," "explain," "compare," and "plan." This creates an implicit language policy in the skill's natural-language interface without offering users a language choice or documenting that English input is required.
The manifest frames this skill as modeling sparse activation, async execution, and resource allocation for efficient AI architecture. This script not only analyzes/simulates efficiency but also persists output to a local file, which is an additional operational behavior not mentioned in the skill description.
No suspicious patterns detected.