Habilidades un-editorial-check

📦

un-editorial-check

Name: un-editorial-check
Author: ahaomar

v1.7.0 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos📁 Acceso al sistema de archivos🔑 Variables de entorno🌐 Acceso a red⚡ Contiene scripts

Review Copy Against UN Editorial Rules

Editorial inconsistencies and sensitive wording are difficult to track across documents and websites. This skill checks extracted English copy and separates rule violations from human review.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "un-editorial-check" from https://skillstore.io/skills/ahaomar-un-editorial-check.md and its manifest at https://skillstore.io/api/skills/ahaomar-un-editorial-check/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/ahaomar-un-editorial-check.md Manifest firmado GET /api/skills/ahaomar-un-editorial-check/manifest Lockfile firmado GET /api/skills/ahaomar-un-editorial-check/lockfile

Pruébalo

Usando "un-editorial-check". Draft text: The color of the cover was noted.

Resultado esperado:

Deterministic spelling finding: color.
Suggested wording: colour.
The checker reports the matching rule and source. The draft remains unchanged until an approved fix is applied.

Usando "un-editorial-check". An image-only PDF with no recoverable text.

Resultado esperado:

Extraction refused: the document appears to contain scanned images without extractable text.
The run returns exit code 2. The document is not reported as checked or clean.

Usando "un-editorial-check". A claim-register entry contains a source but no reference date.

Resultado esperado:

Human review required: record the reference date for the registered claim.
Register completeness does not establish that the claim is true.

Auditoría de seguridad

Riesgo alto

v1 • 2/10/2026 Abrir el informe versionado

Of 400 supplied findings, 394 are false positives; six confirm unsafe baseline creation or blocking special-file reads, with additional PDF denial-of-service risk. No evidence found of prompt injection or intentional data exfiltration in reviewed context. Review was capped at 400 of 5,037 matches; the remaining 4,637 require manual review before automatic publication. Static review was capped at 400/5037 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

251

Archivos escaneados

41,276

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Alto

lib/pdf-parse.mjs:815-860 lib/pdf-parse.mjs:871-890 SECURITY.md:25

Unbounded PDF Parsing Can Exhaust Resources

PDF filter chains decompress synchronously without a decoded-byte budget or execution deadline. A hostile document can exhaust memory or block an agent or CI process.

The inflate calls omit maxOutputLength, and the filter chain has no cumulative decoded-byte budget. The security policy explicitly acknowledges unsandboxed denial-of-service exposure.

Elementos de revisión de capacidades (6)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

lib/baseline.mjs:111

Node.js fs operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Medio

lib/baseline.mjs:162

Node.js fs operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Medio

lib/claims.mjs:95

Node.js fs operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Medio

lib/baseline.mjs:111

Synchronous file operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Medio

lib/baseline.mjs:162

Synchronous file operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Medio

lib/claims.mjs:95

Synchronous file operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Factores de riesgo

⚙️ Comandos externos (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:25 .github/workflows/ci.yml:37 .github/workflows/ci.yml:38 docs/npm-metadata.md:199 lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/audits.mjs:62 lib/audits.mjs:67 lib/audits.mjs:80 lib/audits.mjs:95 lib/audits.mjs:103 lib/audits.mjs:109 lib/audits.mjs:144 lib/audits.mjs:146 lib/audits.mjs:157 lib/audits.mjs:194 lib/audits.mjs:248 lib/baseline.mjs:1 lib/baseline.mjs:5 lib/baseline.mjs:34 lib/baseline.mjs:46 lib/baseline.mjs:48 lib/baseline.mjs:75 lib/baseline.mjs:84 lib/baseline.mjs:86 lib/baseline.mjs:89 lib/baseline.mjs:91 lib/baseline.mjs:94 lib/baseline.mjs:105 lib/baseline.mjs:114 lib/baseline.mjs:140 lib/baseline.mjs:164 lib/baseline.mjs:170 lib/baseline.mjs:179 lib/baseline.mjs:181 lib/baseline.mjs:182 lib/baseline.mjs:183 lib/claims.mjs:7 lib/claims.mjs:12 lib/claims.mjs:50 lib/claims.mjs:52 lib/claims.mjs:56

📁 Acceso al sistema de archivos (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:40 .github/workflows/ci.yml:38 action/main.mjs:7 bin/check.mjs:20 bin/check.mjs:8 bin/check.mjs:9 CHANGELOG.md:47 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 docs/demo/README.md:103 docs/demo/README.md:104 docs/demo/README.md:105 docs/demo/README.md:106 docs/demo/README.md:93 docs/demo/README.md:94 docs/demo/README.md:95 docs/GLOSSARY-AND-WATCH.md:281 docs/GLOSSARY-AND-WATCH.md:282 docs/GLOSSARY-AND-WATCH.md:287 docs/GLOSSARY-AND-WATCH.md:296 docs/LAUNCH-1.2.0.md:72 docs/LAUNCH-1.2.0.md:75 docs/LAUNCH.md:34 docs/LAUNCH.md:81 docs/LAUNCH.md:96 docs/LAUNCH.md:97 docs/LAUNCH.md:98 docs/LAUNCH.md:102 docs/MIGRATION.md:3

🔑 Variables de entorno (12)

action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 tests/audit-adoption.mjs:506 tests/audit-adoption.mjs:515 tests/audit-adoption.mjs:521 tests/fixtures/negative/hs-legal-individuals.txt:3

🌐 Acceso a red (50)

COMPATIBILITY.md:40 COMPATIBILITY.md:41 COMPATIBILITY.md:42 COMPATIBILITY.md:43 COMPATIBILITY.md:44 COMPATIBILITY.md:45 COMPATIBILITY.md:46 COMPATIBILITY.md:47 COMPATIBILITY.md:48 COMPATIBILITY.md:49 config/example.un-editorial.json:7 config/profiles/generic-british-english.json:4 config/profiles/un-geneva-web.json:4 config/profiles/un-v1.json:4 docs/npm-metadata.md:188 lib/audits.mjs:157 lib/cli.mjs:41 lib/fetch.mjs:58 lib/init.mjs:161 lib/output.mjs:401 lib/rules-hs.mjs:43 lib/rules-hs.mjs:68 lib/rules-hs.mjs:99 lib/rules-hs.mjs:138 package.json:62 package.json:64 package.json:66 README.md:122 README.md:131 README.md:135 README.md:139 README.md:143 README.md:147 README.md:148 README.md:149 README.md:150 README.md:151 README.md:163 README.md:186 README.md:207 README.md:222 README.md:249 README.md:379 README.md:564 README.md:585 README.md:586 README.md:682 rules/sources.json:9 rules/sources.json:18 rules/sources.json:25

⚡ Contiene scripts (50)

lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/extract-html.mjs:113 lib/extract-js.mjs:214 lib/extract-js.mjs:232 lib/furniture.mjs:66 lib/furniture.mjs:96 lib/furniture.mjs:165 lib/icons.mjs:166 lib/office.mjs:192 lib/office.mjs:246 lib/pdf-extract.mjs:157 lib/pdf-parse.mjs:973 lib/pdf-parse.mjs:992 lib/pdf-parse.mjs:1002 lib/pdf-parse.mjs:1225 lib/pdf-parse.mjs:1296 lib/pdf-text.mjs:190 lib/pdf.mjs:111 lib/pdf.mjs:310 lib/pdf.mjs:515 lib/rules-grammar.mjs:77 lib/rules-grammar.mjs:114 lib/rules-grammar.mjs:151 lib/rules-hs.mjs:285 lib/rules-hs.mjs:295 lib/rules-hs.mjs:322 lib/rules-hs.mjs:336 lib/rules-hs.mjs:353 lib/rules-hs.mjs:394 lib/rules-hs.mjs:408 lib/rules-hs.mjs:425 lib/rules-hs.mjs:427 lib/rules-hs.mjs:489 lib/rules-tone.mjs:42 lib/rules-tone.mjs:64 lib/rules-tone.mjs:99 lib/rules.mjs:201 lib/rules.mjs:247 lib/rules.mjs:250 lib/rules.mjs:267 lib/rules.mjs:342 lib/rules.mjs:392 lib/rules.mjs:411

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg)](https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/ahaomar-un-editorial-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

ahaomar. (2026). un-editorial-check security audit report (audit version 1) [Author version 1.7.0]. Skillstore. https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1

Cita BibTeX

@techreport{ahaomar-ahaomar-un-editorial-check-2026,
  author = {ahaomar},
  title = {un-editorial-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1},
  note = {Author version 1.7.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "un-editorial-check security audit report (audit version 1)"
version: "1.7.0"
type: report
authors:
  - name: "ahaomar"
date-released: "2026-10-02"
url: "https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:ahaomar-un-editorial-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

100

Cumplimiento de la especificación

Lo que puedes crear

Review Institutional Publications

Check briefing papers for spelling, dates, terminology, and sensitive wording while preserving source references for editorial decisions.

Check Product Interface Copy

Review visible HTML and supported JavaScript copy before release, with optional publishing or accessibility findings reported separately.

Track Evidence Review

Create a claim register for detected figures and comparisons, then check source and reference-date completeness after human review.

Prueba estos prompts

Review One Draft

Review [draft.md] with un-editorial-check. Report deterministic violations separately from findings requiring human review. Do not modify the file.

Prepare an Editorial Report

Check [document.pdf] and write an HTML review report to [report.html]. Preserve rule sources and PDF page references. State extraction refusals clearly.

Preview Approved Corrections

Show the target files in [content-directory]. Preview deterministic fixes for eligible prose files. Request approval before applying changes, then review the resulting diff.

Integrate Evidence and Baseline Checks

Check [content-directory] using [organization-profile.json] and [claims.json]. Compare [baseline.json] and export SARIF. Keep optional audit findings separate from editorial failures.

Mejores prácticas

Keep rule sources, confidence labels, and human-review recommendations attached to each finding.
Show target files and preview corrections before approving writes; review every resulting diff.
Use isolated, resource-limited processing for untrusted documents and review every extraction refusal.

Evitar

Treating a clean run as factual verification, legal clearance, or United Nations approval.
Automatically rewriting sensitive terminology, claims, or diplomatic language from heuristic findings.
Using watch mode in CI or relying on optional audit findings to determine the process exit code.

Preguntas frecuentes

Which assistants can use this skill?

The portable skill supports Claude, Codex, and Claude Code where the host can load skills and run Node.js 18 or later.

Does it verify facts or provide United Nations approval?

No. It checks documented local rules and identifies review needs. It does not verify claims or represent United Nations endorsement.

Which files can it review?

It reads HTML, Markdown, plain text, supported JavaScript copy, recoverable PDF text, and Word or OpenDocument body text.

Will it rewrite my documents automatically?

No. Fix mode previews changes. Applying approved corrections requires an additional option and is limited to eligible Markdown and plain-text files.

Does it retrieve pages or upload my documents?

It retrieves explicitly supplied HTTP(S) pages and follows redirects. The reviewed retrieval code sends no document body or environment secrets.

What do exit codes mean?

Normally, 0 means no editorial errors, 1 means editorial errors, and 2 means failure. Baseline mode can accept existing errors; optional audits never fail.