de-ai-polish
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill incorporates a local Python script located at
scripts/fix_punctuation.pyto automate the conversion of English punctuation to Chinese counterparts during the final processing stage. The script utilizes standard libraries (re,sys,os) and performs string manipulation locally on the provided file path without network access or sensitive system calls. - [COMMAND_EXECUTION]: The instructions in
SKILL.mddefine an operational workflow that requires the execution of shell commands, specifically the punctuation correction script (python3 scripts/fix_punctuation.py <文件路径>). This is a transparent and documented part of the skill's primary functionality. - [INDIRECT_PROMPT_INJECTION]: As a text-processing tool, the skill is designed to ingest untrusted user-provided content (e.g.,
@article.md). Although this constitutes an attack surface, the risk is mitigated by the skill's specific focus on stylistic rewriting and the lack of high-privilege capabilities that could be exploited through malicious text content.
Audit Metadata