nsfc-research-content-writer
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
subprocess.runinscripts/run_checks.pyto execute internal validation scripts (validate_skill.py,check_project_outputs.py). The execution uses argument lists and avoids shell invocation, which is a safe practice for running local utility scripts. - [DATA_EXFILTRATION]: The skill includes a bug reporting feature that, upon explicit user request, uses the GitHub CLI (
gh) to upload bug reports to the author's repository (huangwb8/bensz-bugs). This is a documented developer-oriented feature for skill maintenance and utilizes the vendor's own infrastructure. - [SAFE]: The skill implements strict file access controls defined in
config.yaml, explicitly listing allowed target files (e.g.,extraTex/2.1.研究内容.tex) and forbidden files (e.g.,main.tex,.cls,.sty) to prevent accidental or unauthorized modification of the project's core structure. - [SAFE]: Local state management for bug reports is handled by writing to a dedicated hidden directory (
~/.bensz-skills/bugs/), which is a standard and acceptable practice for local tools.
Audit Metadata