Habilidades un-editorial-check

📦

un-editorial-check

Name: un-editorial-check
Author: ahaomar

v1.7.0 Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos📁 Acesso ao sistema de arquivos🔑 Variáveis de ambiente🌐 Acesso à rede⚡ Contém scripts

Review Copy Against UN Editorial Rules

Editorial inconsistencies and sensitive wording are difficult to track across documents and websites. This skill checks extracted English copy and separates rule violations from human review.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "un-editorial-check" from https://skillstore.io/skills/ahaomar-un-editorial-check.md and its manifest at https://skillstore.io/api/skills/ahaomar-un-editorial-check/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/ahaomar-un-editorial-check.md manifest assinado GET /api/skills/ahaomar-un-editorial-check/manifest lockfile assinado GET /api/skills/ahaomar-un-editorial-check/lockfile

Testar

Usando "un-editorial-check". Draft text: The color of the cover was noted.

Resultado esperado:

Deterministic spelling finding: color.
Suggested wording: colour.
The checker reports the matching rule and source. The draft remains unchanged until an approved fix is applied.

Usando "un-editorial-check". An image-only PDF with no recoverable text.

Resultado esperado:

Extraction refused: the document appears to contain scanned images without extractable text.
The run returns exit code 2. The document is not reported as checked or clean.

Usando "un-editorial-check". A claim-register entry contains a source but no reference date.

Resultado esperado:

Human review required: record the reference date for the registered claim.
Register completeness does not establish that the claim is true.

Auditoria de segurança

Risco alto

v1 • 02/10/2026 Abrir o relatório versionado

Of 400 supplied findings, 394 are false positives; six confirm unsafe baseline creation or blocking special-file reads, with additional PDF denial-of-service risk. No evidence found of prompt injection or intentional data exfiltration in reviewed context. Review was capped at 400 of 5,037 matches; the remaining 4,637 require manual review before automatic publication. Static review was capped at 400/5037 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

251

Arquivos analisados

41,276

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (1)

Alto

lib/pdf-parse.mjs:815-860 lib/pdf-parse.mjs:871-890 SECURITY.md:25

Unbounded PDF Parsing Can Exhaust Resources

PDF filter chains decompress synchronously without a decoded-byte budget or execution deadline. A hostile document can exhaust memory or block an agent or CI process.

The inflate calls omit maxOutputLength, and the filter chain has no cumulative decoded-byte budget. The security policy explicitly acknowledges unsandboxed denial-of-service exposure.

Itens de revisão de capacidade (6)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Médio

lib/baseline.mjs:111

Node.js fs operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Médio

lib/baseline.mjs:162

Node.js fs operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Médio

lib/claims.mjs:95

Node.js fs operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Médio

lib/baseline.mjs:111

Synchronous file operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Médio

lib/baseline.mjs:162

Synchronous file operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

Médio

lib/claims.mjs:95

Synchronous file operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

Fatores de risco

⚙️ Comandos externos (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:25 .github/workflows/ci.yml:37 .github/workflows/ci.yml:38 docs/npm-metadata.md:199 lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/audits.mjs:62 lib/audits.mjs:67 lib/audits.mjs:80 lib/audits.mjs:95 lib/audits.mjs:103 lib/audits.mjs:109 lib/audits.mjs:144 lib/audits.mjs:146 lib/audits.mjs:157 lib/audits.mjs:194 lib/audits.mjs:248 lib/baseline.mjs:1 lib/baseline.mjs:5 lib/baseline.mjs:34 lib/baseline.mjs:46 lib/baseline.mjs:48 lib/baseline.mjs:75 lib/baseline.mjs:84 lib/baseline.mjs:86 lib/baseline.mjs:89 lib/baseline.mjs:91 lib/baseline.mjs:94 lib/baseline.mjs:105 lib/baseline.mjs:114 lib/baseline.mjs:140 lib/baseline.mjs:164 lib/baseline.mjs:170 lib/baseline.mjs:179 lib/baseline.mjs:181 lib/baseline.mjs:182 lib/baseline.mjs:183 lib/claims.mjs:7 lib/claims.mjs:12 lib/claims.mjs:50 lib/claims.mjs:52 lib/claims.mjs:56

📁 Acesso ao sistema de arquivos (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:40 .github/workflows/ci.yml:38 action/main.mjs:7 bin/check.mjs:20 bin/check.mjs:8 bin/check.mjs:9 CHANGELOG.md:47 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 docs/demo/README.md:103 docs/demo/README.md:104 docs/demo/README.md:105 docs/demo/README.md:106 docs/demo/README.md:93 docs/demo/README.md:94 docs/demo/README.md:95 docs/GLOSSARY-AND-WATCH.md:281 docs/GLOSSARY-AND-WATCH.md:282 docs/GLOSSARY-AND-WATCH.md:287 docs/GLOSSARY-AND-WATCH.md:296 docs/LAUNCH-1.2.0.md:72 docs/LAUNCH-1.2.0.md:75 docs/LAUNCH.md:34 docs/LAUNCH.md:81 docs/LAUNCH.md:96 docs/LAUNCH.md:97 docs/LAUNCH.md:98 docs/LAUNCH.md:102 docs/MIGRATION.md:3

🔑 Variáveis de ambiente (12)

action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 tests/audit-adoption.mjs:506 tests/audit-adoption.mjs:515 tests/audit-adoption.mjs:521 tests/fixtures/negative/hs-legal-individuals.txt:3

🌐 Acesso à rede (50)

COMPATIBILITY.md:40 COMPATIBILITY.md:41 COMPATIBILITY.md:42 COMPATIBILITY.md:43 COMPATIBILITY.md:44 COMPATIBILITY.md:45 COMPATIBILITY.md:46 COMPATIBILITY.md:47 COMPATIBILITY.md:48 COMPATIBILITY.md:49 config/example.un-editorial.json:7 config/profiles/generic-british-english.json:4 config/profiles/un-geneva-web.json:4 config/profiles/un-v1.json:4 docs/npm-metadata.md:188 lib/audits.mjs:157 lib/cli.mjs:41 lib/fetch.mjs:58 lib/init.mjs:161 lib/output.mjs:401 lib/rules-hs.mjs:43 lib/rules-hs.mjs:68 lib/rules-hs.mjs:99 lib/rules-hs.mjs:138 package.json:62 package.json:64 package.json:66 README.md:122 README.md:131 README.md:135 README.md:139 README.md:143 README.md:147 README.md:148 README.md:149 README.md:150 README.md:151 README.md:163 README.md:186 README.md:207 README.md:222 README.md:249 README.md:379 README.md:564 README.md:585 README.md:586 README.md:682 rules/sources.json:9 rules/sources.json:18 rules/sources.json:25

⚡ Contém scripts (50)

lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/extract-html.mjs:113 lib/extract-js.mjs:214 lib/extract-js.mjs:232 lib/furniture.mjs:66 lib/furniture.mjs:96 lib/furniture.mjs:165 lib/icons.mjs:166 lib/office.mjs:192 lib/office.mjs:246 lib/pdf-extract.mjs:157 lib/pdf-parse.mjs:973 lib/pdf-parse.mjs:992 lib/pdf-parse.mjs:1002 lib/pdf-parse.mjs:1225 lib/pdf-parse.mjs:1296 lib/pdf-text.mjs:190 lib/pdf.mjs:111 lib/pdf.mjs:310 lib/pdf.mjs:515 lib/rules-grammar.mjs:77 lib/rules-grammar.mjs:114 lib/rules-grammar.mjs:151 lib/rules-hs.mjs:285 lib/rules-hs.mjs:295 lib/rules-hs.mjs:322 lib/rules-hs.mjs:336 lib/rules-hs.mjs:353 lib/rules-hs.mjs:394 lib/rules-hs.mjs:408 lib/rules-hs.mjs:425 lib/rules-hs.mjs:427 lib/rules-hs.mjs:489 lib/rules-tone.mjs:42 lib/rules-tone.mjs:64 lib/rules-tone.mjs:99 lib/rules.mjs:201 lib/rules.mjs:247 lib/rules.mjs:250 lib/rules.mjs:267 lib/rules.mjs:342 lib/rules.mjs:392 lib/rules.mjs:411

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg)](https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/ahaomar-un-editorial-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

ahaomar. (2026). un-editorial-check security audit report (audit version 1) [Author version 1.7.0]. Skillstore. https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1

Citação BibTeX

@techreport{ahaomar-ahaomar-un-editorial-check-2026,
  author = {ahaomar},
  title = {un-editorial-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1},
  note = {Author version 1.7.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "un-editorial-check security audit report (audit version 1)"
version: "1.7.0"
type: report
authors:
  - name: "ahaomar"
date-released: "2026-10-02"
url: "https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:ahaomar-un-editorial-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

100

Manutenibilidade

Conteúdo

Comunidade

100

Conformidade com a especificação

O que você pode criar

Review Institutional Publications

Check briefing papers for spelling, dates, terminology, and sensitive wording while preserving source references for editorial decisions.

Check Product Interface Copy

Review visible HTML and supported JavaScript copy before release, with optional publishing or accessibility findings reported separately.

Track Evidence Review

Create a claim register for detected figures and comparisons, then check source and reference-date completeness after human review.

Teste estes prompts

Review One Draft

Review [draft.md] with un-editorial-check. Report deterministic violations separately from findings requiring human review. Do not modify the file.

Prepare an Editorial Report

Check [document.pdf] and write an HTML review report to [report.html]. Preserve rule sources and PDF page references. State extraction refusals clearly.

Preview Approved Corrections

Show the target files in [content-directory]. Preview deterministic fixes for eligible prose files. Request approval before applying changes, then review the resulting diff.

Integrate Evidence and Baseline Checks

Check [content-directory] using [organization-profile.json] and [claims.json]. Compare [baseline.json] and export SARIF. Keep optional audit findings separate from editorial failures.

Boas práticas

Keep rule sources, confidence labels, and human-review recommendations attached to each finding.
Show target files and preview corrections before approving writes; review every resulting diff.
Use isolated, resource-limited processing for untrusted documents and review every extraction refusal.

Evitar

Treating a clean run as factual verification, legal clearance, or United Nations approval.
Automatically rewriting sensitive terminology, claims, or diplomatic language from heuristic findings.
Using watch mode in CI or relying on optional audit findings to determine the process exit code.

Perguntas frequentes

Which assistants can use this skill?

The portable skill supports Claude, Codex, and Claude Code where the host can load skills and run Node.js 18 or later.

Does it verify facts or provide United Nations approval?

No. It checks documented local rules and identifies review needs. It does not verify claims or represent United Nations endorsement.

Which files can it review?

It reads HTML, Markdown, plain text, supported JavaScript copy, recoverable PDF text, and Word or OpenDocument body text.

Will it rewrite my documents automatically?

No. Fix mode previews changes. Applying approved corrections requires an additional option and is limited to eligible Markdown and plain-text files.

Does it retrieve pages or upload my documents?

It retrieves explicitly supplied HTTP(S) pages and follows redirects. The reviewed retrieval code sends no document body or environment secrets.

What do exit codes mean?

Normally, 0 means no editorial errors, 1 means editorial errors, and 2 means failure. Baseline mode can accept existing errors; optional audits never fail.