Fähigkeiten un-editorial-check

📦

un-editorial-check

Name: un-editorial-check
Author: ahaomar

v1.7.0 Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle📁 Dateisystemzugriff🔑 Umgebungsvariablen🌐 Netzwerkzugriff⚡ Enthält Skripte

Review Copy Against UN Editorial Rules

Editorial inconsistencies and sensitive wording are difficult to track across documents and websites. This skill checks extracted English copy and separates rule violations from human review.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "un-editorial-check" from https://skillstore.io/skills/ahaomar-un-editorial-check.md and its manifest at https://skillstore.io/api/skills/ahaomar-un-editorial-check/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/ahaomar-un-editorial-check.md Signiertes manifest GET /api/skills/ahaomar-un-editorial-check/manifest Signiertes lockfile GET /api/skills/ahaomar-un-editorial-check/lockfile

Testen

„un-editorial-check“ wird verwendet. Draft text: The color of the cover was noted.

Erwartetes Ergebnis:

Deterministic spelling finding: color.
Suggested wording: colour.
The checker reports the matching rule and source. The draft remains unchanged until an approved fix is applied.

„un-editorial-check“ wird verwendet. An image-only PDF with no recoverable text.

Erwartetes Ergebnis:

Extraction refused: the document appears to contain scanned images without extractable text.
The run returns exit code 2. The document is not reported as checked or clean.

„un-editorial-check“ wird verwendet. A claim-register entry contains a source but no reference date.

Erwartetes Ergebnis:

Human review required: record the reference date for the registered claim.
Register completeness does not establish that the claim is true.

Sicherheitsaudit

Hohes Risiko

v1 • 2.10.2026 Versionsbericht öffnen

Of 400 supplied findings, 394 are false positives; six confirm unsafe baseline creation or blocking special-file reads, with additional PDF denial-of-service risk. No evidence found of prompt injection or intentional data exfiltration in reviewed context. Review was capped at 400 of 5,037 matches; the remaining 4,637 require manual review before automatic publication. Static review was capped at 400/5037 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

251

Gescannte Dateien

41,276

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Hoch

lib/pdf-parse.mjs:815-860 lib/pdf-parse.mjs:871-890 SECURITY.md:25

Unbounded PDF Parsing Can Exhaust Resources

PDF filter chains decompress synchronously without a decoded-byte budget or execution deadline. A hostile document can exhaust memory or block an agent or CI process.

The inflate calls omit maxOutputLength, and the filter chain has no cumulative decoded-byte budget. The security policy explicitly acknowledges unsandboxed denial-of-service exposure.

Elemente der Fähigkeitsprüfung (6)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel

lib/baseline.mjs:111

Node.js fs operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Mittel

lib/baseline.mjs:162

Node.js fs operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Mittel

lib/claims.mjs:95

Node.js fs operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Mittel

lib/baseline.mjs:111

Synchronous file operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Mittel

lib/baseline.mjs:162

Synchronous file operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Mittel

lib/claims.mjs:95

Synchronous file operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Risikofaktoren

⚙️ Externe Befehle (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:25 .github/workflows/ci.yml:37 .github/workflows/ci.yml:38 docs/npm-metadata.md:199 lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/audits.mjs:62 lib/audits.mjs:67 lib/audits.mjs:80 lib/audits.mjs:95 lib/audits.mjs:103 lib/audits.mjs:109 lib/audits.mjs:144 lib/audits.mjs:146 lib/audits.mjs:157 lib/audits.mjs:194 lib/audits.mjs:248 lib/baseline.mjs:1 lib/baseline.mjs:5 lib/baseline.mjs:34 lib/baseline.mjs:46 lib/baseline.mjs:48 lib/baseline.mjs:75 lib/baseline.mjs:84 lib/baseline.mjs:86 lib/baseline.mjs:89 lib/baseline.mjs:91 lib/baseline.mjs:94 lib/baseline.mjs:105 lib/baseline.mjs:114 lib/baseline.mjs:140 lib/baseline.mjs:164 lib/baseline.mjs:170 lib/baseline.mjs:179 lib/baseline.mjs:181 lib/baseline.mjs:182 lib/baseline.mjs:183 lib/claims.mjs:7 lib/claims.mjs:12 lib/claims.mjs:50 lib/claims.mjs:52 lib/claims.mjs:56

📁 Dateisystemzugriff (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:40 .github/workflows/ci.yml:38 action/main.mjs:7 bin/check.mjs:20 bin/check.mjs:8 bin/check.mjs:9 CHANGELOG.md:47 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 docs/demo/README.md:103 docs/demo/README.md:104 docs/demo/README.md:105 docs/demo/README.md:106 docs/demo/README.md:93 docs/demo/README.md:94 docs/demo/README.md:95 docs/GLOSSARY-AND-WATCH.md:281 docs/GLOSSARY-AND-WATCH.md:282 docs/GLOSSARY-AND-WATCH.md:287 docs/GLOSSARY-AND-WATCH.md:296 docs/LAUNCH-1.2.0.md:72 docs/LAUNCH-1.2.0.md:75 docs/LAUNCH.md:34 docs/LAUNCH.md:81 docs/LAUNCH.md:96 docs/LAUNCH.md:97 docs/LAUNCH.md:98 docs/LAUNCH.md:102 docs/MIGRATION.md:3

🔑 Umgebungsvariablen (12)

action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 tests/audit-adoption.mjs:506 tests/audit-adoption.mjs:515 tests/audit-adoption.mjs:521 tests/fixtures/negative/hs-legal-individuals.txt:3

🌐 Netzwerkzugriff (50)

COMPATIBILITY.md:40 COMPATIBILITY.md:41 COMPATIBILITY.md:42 COMPATIBILITY.md:43 COMPATIBILITY.md:44 COMPATIBILITY.md:45 COMPATIBILITY.md:46 COMPATIBILITY.md:47 COMPATIBILITY.md:48 COMPATIBILITY.md:49 config/example.un-editorial.json:7 config/profiles/generic-british-english.json:4 config/profiles/un-geneva-web.json:4 config/profiles/un-v1.json:4 docs/npm-metadata.md:188 lib/audits.mjs:157 lib/cli.mjs:41 lib/fetch.mjs:58 lib/init.mjs:161 lib/output.mjs:401 lib/rules-hs.mjs:43 lib/rules-hs.mjs:68 lib/rules-hs.mjs:99 lib/rules-hs.mjs:138 package.json:62 package.json:64 package.json:66 README.md:122 README.md:131 README.md:135 README.md:139 README.md:143 README.md:147 README.md:148 README.md:149 README.md:150 README.md:151 README.md:163 README.md:186 README.md:207 README.md:222 README.md:249 README.md:379 README.md:564 README.md:585 README.md:586 README.md:682 rules/sources.json:9 rules/sources.json:18 rules/sources.json:25

⚡ Enthält Skripte (50)

lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/extract-html.mjs:113 lib/extract-js.mjs:214 lib/extract-js.mjs:232 lib/furniture.mjs:66 lib/furniture.mjs:96 lib/furniture.mjs:165 lib/icons.mjs:166 lib/office.mjs:192 lib/office.mjs:246 lib/pdf-extract.mjs:157 lib/pdf-parse.mjs:973 lib/pdf-parse.mjs:992 lib/pdf-parse.mjs:1002 lib/pdf-parse.mjs:1225 lib/pdf-parse.mjs:1296 lib/pdf-text.mjs:190 lib/pdf.mjs:111 lib/pdf.mjs:310 lib/pdf.mjs:515 lib/rules-grammar.mjs:77 lib/rules-grammar.mjs:114 lib/rules-grammar.mjs:151 lib/rules-hs.mjs:285 lib/rules-hs.mjs:295 lib/rules-hs.mjs:322 lib/rules-hs.mjs:336 lib/rules-hs.mjs:353 lib/rules-hs.mjs:394 lib/rules-hs.mjs:408 lib/rules-hs.mjs:425 lib/rules-hs.mjs:427 lib/rules-hs.mjs:489 lib/rules-tone.mjs:42 lib/rules-tone.mjs:64 lib/rules-tone.mjs:99 lib/rules.mjs:201 lib/rules.mjs:247 lib/rules.mjs:250 lib/rules.mjs:267 lib/rules.mjs:342 lib/rules.mjs:392 lib/rules.mjs:411

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg)](https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/ahaomar-un-editorial-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

ahaomar. (2026). un-editorial-check security audit report (audit version 1) [Author version 1.7.0]. Skillstore. https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1

BibTeX-Zitat

@techreport{ahaomar-ahaomar-un-editorial-check-2026,
  author = {ahaomar},
  title = {un-editorial-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1},
  note = {Author version 1.7.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "un-editorial-check security audit report (audit version 1)"
version: "1.7.0"
type: report
authors:
  - name: "ahaomar"
date-released: "2026-10-02"
url: "https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:ahaomar-un-editorial-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

100

Wartbarkeit

Inhalt

Gemeinschaft

100

Spezifikationskonformität

Was Sie erstellen können

Review Institutional Publications

Check briefing papers for spelling, dates, terminology, and sensitive wording while preserving source references for editorial decisions.

Check Product Interface Copy

Review visible HTML and supported JavaScript copy before release, with optional publishing or accessibility findings reported separately.

Track Evidence Review

Create a claim register for detected figures and comparisons, then check source and reference-date completeness after human review.

Diese Prompts ausprobieren

Review One Draft

Review [draft.md] with un-editorial-check. Report deterministic violations separately from findings requiring human review. Do not modify the file.

Prepare an Editorial Report

Check [document.pdf] and write an HTML review report to [report.html]. Preserve rule sources and PDF page references. State extraction refusals clearly.

Preview Approved Corrections

Show the target files in [content-directory]. Preview deterministic fixes for eligible prose files. Request approval before applying changes, then review the resulting diff.

Integrate Evidence and Baseline Checks

Check [content-directory] using [organization-profile.json] and [claims.json]. Compare [baseline.json] and export SARIF. Keep optional audit findings separate from editorial failures.

Bewährte Praktiken

Keep rule sources, confidence labels, and human-review recommendations attached to each finding.
Show target files and preview corrections before approving writes; review every resulting diff.
Use isolated, resource-limited processing for untrusted documents and review every extraction refusal.

Vermeiden

Treating a clean run as factual verification, legal clearance, or United Nations approval.
Automatically rewriting sensitive terminology, claims, or diplomatic language from heuristic findings.
Using watch mode in CI or relying on optional audit findings to determine the process exit code.

Häufig gestellte Fragen

Which assistants can use this skill?

The portable skill supports Claude, Codex, and Claude Code where the host can load skills and run Node.js 18 or later.

Does it verify facts or provide United Nations approval?

No. It checks documented local rules and identifies review needs. It does not verify claims or represent United Nations endorsement.

Which files can it review?

It reads HTML, Markdown, plain text, supported JavaScript copy, recoverable PDF text, and Word or OpenDocument body text.

Will it rewrite my documents automatically?

No. Fix mode previews changes. Applying approved corrections requires an additional option and is limited to eligible Markdown and plain-text files.

Does it retrieve pages or upload my documents?

It retrieves explicitly supplied HTTP(S) pages and follows redirects. The reviewed retrieval code sends no document body or environment secrets.

What do exit codes mean?

Normally, 0 means no editorial errors, 1 means editorial errors, and 2 means failure. Baseline mode can accept existing errors; optional audits never fail.