kol-writer

结论为 SUSPICIOUS。主体功能与“写作大纲/语料管理”基本一致，但存在高风险安装信任问题：工作流要求执行未披露来源的本地二进制 ./scratch/ocr，且还可把研究目标经第三方 markdown.new 处理中转；再叠加同个人仓库 bundled 子技能带来的转移信任，整体风险高于普通文档型技能。

The fragment appears to be a research workspace visualization server, not malware. It contains no evident supply-chain payload, data exfiltration, command execution, or persistence. However, binding to all interfaces without authentication exposes reports, metadata, and static files to reachable clients. The 404 response leaks filesystem/environment information and interpolates unescaped values into HTML, creating a potential reflected HTML injection issue. Restrict binding to localhost or add authentication, escape HTML output, validate serving paths, and impose size/resource limits.

No malicious software or supply-chain attack behavior is present because the submission is non-executable prose. The content does present a moderate safety risk as health and chemical-use misinformation, particularly the off-label use of metronidazole, pesticide mopping, and unsupported treatment advice for children and infants. Medical and pesticide instructions should be removed or replaced with evidence-based, label-compliant guidance and appropriate professional warnings.

该技能更像是高暴露面的第三方内容转换代理，而非恶意软件。目的与能力基本一致，也没有可疑安装器或凭证窃取迹象；但它会把用户指定 URL、搜索查询及可选本地文件发送给 markdown.new，并可能经额外第三方处理，且 crawl 结果会被服务端保留一段时间。总体应判定为 SUSPICIOUS：主要风险在第三方中转、文件外发和间接提示注入，不是已确认恶意。