Compétences un-editorial-check

📦

un-editorial-check

Name: un-editorial-check
Author: ahaomar

v1.7.0 Révision du contenu r1 Risque élevé ⚙️ Commandes externes📁 Accès au système de fichiers🔑 Variables d’environnement🌐 Accès réseau⚡ Contient des scripts

Review Copy Against UN Editorial Rules

Editorial inconsistencies and sensitive wording are difficult to track across documents and websites. This skill checks extracted English copy and separates rule violations from human review.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "un-editorial-check" from https://skillstore.io/skills/ahaomar-un-editorial-check.md and its manifest at https://skillstore.io/api/skills/ahaomar-un-editorial-check/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/ahaomar-un-editorial-check.md manifest signé GET /api/skills/ahaomar-un-editorial-check/manifest lockfile signé GET /api/skills/ahaomar-un-editorial-check/lockfile

Tester

Utilisation de « un-editorial-check ». Draft text: The color of the cover was noted.

Résultat attendu:

Deterministic spelling finding: color.
Suggested wording: colour.
The checker reports the matching rule and source. The draft remains unchanged until an approved fix is applied.

Utilisation de « un-editorial-check ». An image-only PDF with no recoverable text.

Résultat attendu:

Extraction refused: the document appears to contain scanned images without extractable text.
The run returns exit code 2. The document is not reported as checked or clean.

Utilisation de « un-editorial-check ». A claim-register entry contains a source but no reference date.

Résultat attendu:

Human review required: record the reference date for the registered claim.
Register completeness does not establish that the claim is true.

Audit de sécurité

Risque élevé

v1 • 02/10/2026 Ouvrir le rapport versionné

Of 400 supplied findings, 394 are false positives; six confirm unsafe baseline creation or blocking special-file reads, with additional PDF denial-of-service risk. No evidence found of prompt injection or intentional data exfiltration in reviewed context. Review was capped at 400 of 5,037 matches; the remaining 4,637 require manual review before automatic publication. Static review was capped at 400/5037 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

251

Fichiers analysés

41,276

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Élevé

lib/pdf-parse.mjs:815-860 lib/pdf-parse.mjs:871-890 SECURITY.md:25

Unbounded PDF Parsing Can Exhaust Resources

PDF filter chains decompress synchronously without a decoded-byte budget or execution deadline. A hostile document can exhaust memory or block an agent or CI process.

The inflate calls omit maxOutputLength, and the filter chain has no cumulative decoded-byte budget. The security policy explicitly acknowledges unsandboxed denial-of-service exposure.

Éléments d’évaluation des capacités (6)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Moyen

lib/baseline.mjs:111

Node.js fs operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Moyen

lib/baseline.mjs:162

Node.js fs operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Moyen

lib/claims.mjs:95

Node.js fs operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Moyen

lib/baseline.mjs:111

Synchronous file operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Moyen

lib/baseline.mjs:162

Synchronous file operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Moyen

lib/claims.mjs:95

Synchronous file operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Facteurs de risque

⚙️ Commandes externes (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:25 .github/workflows/ci.yml:37 .github/workflows/ci.yml:38 docs/npm-metadata.md:199 lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/audits.mjs:62 lib/audits.mjs:67 lib/audits.mjs:80 lib/audits.mjs:95 lib/audits.mjs:103 lib/audits.mjs:109 lib/audits.mjs:144 lib/audits.mjs:146 lib/audits.mjs:157 lib/audits.mjs:194 lib/audits.mjs:248 lib/baseline.mjs:1 lib/baseline.mjs:5 lib/baseline.mjs:34 lib/baseline.mjs:46 lib/baseline.mjs:48 lib/baseline.mjs:75 lib/baseline.mjs:84 lib/baseline.mjs:86 lib/baseline.mjs:89 lib/baseline.mjs:91 lib/baseline.mjs:94 lib/baseline.mjs:105 lib/baseline.mjs:114 lib/baseline.mjs:140 lib/baseline.mjs:164 lib/baseline.mjs:170 lib/baseline.mjs:179 lib/baseline.mjs:181 lib/baseline.mjs:182 lib/baseline.mjs:183 lib/claims.mjs:7 lib/claims.mjs:12 lib/claims.mjs:50 lib/claims.mjs:52 lib/claims.mjs:56

📁 Accès au système de fichiers (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:40 .github/workflows/ci.yml:38 action/main.mjs:7 bin/check.mjs:20 bin/check.mjs:8 bin/check.mjs:9 CHANGELOG.md:47 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 docs/demo/README.md:103 docs/demo/README.md:104 docs/demo/README.md:105 docs/demo/README.md:106 docs/demo/README.md:93 docs/demo/README.md:94 docs/demo/README.md:95 docs/GLOSSARY-AND-WATCH.md:281 docs/GLOSSARY-AND-WATCH.md:282 docs/GLOSSARY-AND-WATCH.md:287 docs/GLOSSARY-AND-WATCH.md:296 docs/LAUNCH-1.2.0.md:72 docs/LAUNCH-1.2.0.md:75 docs/LAUNCH.md:34 docs/LAUNCH.md:81 docs/LAUNCH.md:96 docs/LAUNCH.md:97 docs/LAUNCH.md:98 docs/LAUNCH.md:102 docs/MIGRATION.md:3

🔑 Variables d’environnement (12)

action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 tests/audit-adoption.mjs:506 tests/audit-adoption.mjs:515 tests/audit-adoption.mjs:521 tests/fixtures/negative/hs-legal-individuals.txt:3

🌐 Accès réseau (50)

COMPATIBILITY.md:40 COMPATIBILITY.md:41 COMPATIBILITY.md:42 COMPATIBILITY.md:43 COMPATIBILITY.md:44 COMPATIBILITY.md:45 COMPATIBILITY.md:46 COMPATIBILITY.md:47 COMPATIBILITY.md:48 COMPATIBILITY.md:49 config/example.un-editorial.json:7 config/profiles/generic-british-english.json:4 config/profiles/un-geneva-web.json:4 config/profiles/un-v1.json:4 docs/npm-metadata.md:188 lib/audits.mjs:157 lib/cli.mjs:41 lib/fetch.mjs:58 lib/init.mjs:161 lib/output.mjs:401 lib/rules-hs.mjs:43 lib/rules-hs.mjs:68 lib/rules-hs.mjs:99 lib/rules-hs.mjs:138 package.json:62 package.json:64 package.json:66 README.md:122 README.md:131 README.md:135 README.md:139 README.md:143 README.md:147 README.md:148 README.md:149 README.md:150 README.md:151 README.md:163 README.md:186 README.md:207 README.md:222 README.md:249 README.md:379 README.md:564 README.md:585 README.md:586 README.md:682 rules/sources.json:9 rules/sources.json:18 rules/sources.json:25

⚡ Contient des scripts (50)

lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/extract-html.mjs:113 lib/extract-js.mjs:214 lib/extract-js.mjs:232 lib/furniture.mjs:66 lib/furniture.mjs:96 lib/furniture.mjs:165 lib/icons.mjs:166 lib/office.mjs:192 lib/office.mjs:246 lib/pdf-extract.mjs:157 lib/pdf-parse.mjs:973 lib/pdf-parse.mjs:992 lib/pdf-parse.mjs:1002 lib/pdf-parse.mjs:1225 lib/pdf-parse.mjs:1296 lib/pdf-text.mjs:190 lib/pdf.mjs:111 lib/pdf.mjs:310 lib/pdf.mjs:515 lib/rules-grammar.mjs:77 lib/rules-grammar.mjs:114 lib/rules-grammar.mjs:151 lib/rules-hs.mjs:285 lib/rules-hs.mjs:295 lib/rules-hs.mjs:322 lib/rules-hs.mjs:336 lib/rules-hs.mjs:353 lib/rules-hs.mjs:394 lib/rules-hs.mjs:408 lib/rules-hs.mjs:425 lib/rules-hs.mjs:427 lib/rules-hs.mjs:489 lib/rules-tone.mjs:42 lib/rules-tone.mjs:64 lib/rules-tone.mjs:99 lib/rules.mjs:201 lib/rules.mjs:247 lib/rules.mjs:250 lib/rules.mjs:267 lib/rules.mjs:342 lib/rules.mjs:392 lib/rules.mjs:411

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg)](https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/ahaomar-un-editorial-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

ahaomar. (2026). un-editorial-check security audit report (audit version 1) [Author version 1.7.0]. Skillstore. https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1

Citation BibTeX

@techreport{ahaomar-ahaomar-un-editorial-check-2026,
  author = {ahaomar},
  title = {un-editorial-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1},
  note = {Author version 1.7.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "un-editorial-check security audit report (audit version 1)"
version: "1.7.0"
type: report
authors:
  - name: "ahaomar"
date-released: "2026-10-02"
url: "https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:ahaomar-un-editorial-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

100

Conformité aux spécifications

Ce que vous pouvez créer

Review Institutional Publications

Check briefing papers for spelling, dates, terminology, and sensitive wording while preserving source references for editorial decisions.

Check Product Interface Copy

Review visible HTML and supported JavaScript copy before release, with optional publishing or accessibility findings reported separately.

Track Evidence Review

Create a claim register for detected figures and comparisons, then check source and reference-date completeness after human review.

Essayez ces prompts

Review One Draft

Review [draft.md] with un-editorial-check. Report deterministic violations separately from findings requiring human review. Do not modify the file.

Prepare an Editorial Report

Check [document.pdf] and write an HTML review report to [report.html]. Preserve rule sources and PDF page references. State extraction refusals clearly.

Preview Approved Corrections

Show the target files in [content-directory]. Preview deterministic fixes for eligible prose files. Request approval before applying changes, then review the resulting diff.

Integrate Evidence and Baseline Checks

Check [content-directory] using [organization-profile.json] and [claims.json]. Compare [baseline.json] and export SARIF. Keep optional audit findings separate from editorial failures.

Bonnes pratiques

Keep rule sources, confidence labels, and human-review recommendations attached to each finding.
Show target files and preview corrections before approving writes; review every resulting diff.
Use isolated, resource-limited processing for untrusted documents and review every extraction refusal.

Éviter

Treating a clean run as factual verification, legal clearance, or United Nations approval.
Automatically rewriting sensitive terminology, claims, or diplomatic language from heuristic findings.
Using watch mode in CI or relying on optional audit findings to determine the process exit code.

Foire aux questions

Which assistants can use this skill?

The portable skill supports Claude, Codex, and Claude Code where the host can load skills and run Node.js 18 or later.

Does it verify facts or provide United Nations approval?

No. It checks documented local rules and identifies review needs. It does not verify claims or represent United Nations endorsement.

Which files can it review?

It reads HTML, Markdown, plain text, supported JavaScript copy, recoverable PDF text, and Word or OpenDocument body text.

Will it rewrite my documents automatically?

No. Fix mode previews changes. Applying approved corrections requires an additional option and is limited to eligible Markdown and plain-text files.

Does it retrieve pages or upload my documents?

It retrieves explicitly supplied HTTP(S) pages and follows redirects. The reviewed retrieval code sends no document body or environment secrets.

What do exit codes mean?

Normally, 0 means no editorial errors, 1 means editorial errors, and 2 means failure. Baseline mode can accept existing errors; optional audits never fail.