Most detections are false positives caused by Markdown formatting, protective ignore rules, and readable Chinese text. Five findings remain for project-relative command execution and hidden project-memory access. Repository-controlled context and manifest data also create an indirect prompt-injection risk.
The skill treats optional repository files as supplemental rules and uses repository manifest commands for dispatch. A crafted repository can inject instructions or redirect assistant behavior.
The workflow explicitly loads project-controlled files as rules and dispatch configuration without a trust boundary or validation step.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The line instructs the assistant to run a project-relative Python entrypoint when context is missing. That script is not bundled, so the command can execute unreviewed target-repository code.
- 仅本技能加载时的默认动作:先输出友好欢迎语,告诉用户你已启用 AI Architect Lite,并给出 3 个可选下一步(如:1 生成迷你计划 `python scripts/plan_help
The default workflow offers a project-relative Python helper command as a next action. The helper is absent from the package, so selecting it can run unreviewed repository code.
The line explicitly offers execution of `python scripts/plan_helper.py` from a relative path. The package does not contain that script, so resolution may reach target-controlled code.
The workflow prefers running `python scripts/append_log.py` and describes filesystem writes. Because the advertised script is absent, this can execute unrelated target-repository code.
The workflow checks and may create a fixed file under the hidden `.ai_context` directory. The project-root scope limits traversal, but repository-controlled contents enter the assistant context.
All 32 static findings are false positives or documentation-only references. The skill is readable Markdown and does not contain bundled executable scripts, network requests, secret access, or prompt-injection language. It does instruct assistants to run project-local helper scripts, so users should inspect those scripts before execution.
The workflow recommends running Python entry points located in the target project, but it does not require inspecting them first. A malicious or untrusted repository could place arbitrary code at those paths.
The instructions explicitly name project-local Python entry points and present them as workflow actions. The Markdown does not show their contents or mandate a trust check.
All 32 static findings are false positives or documentation-only references. The skill is readable Markdown and does not contain bundled executable scripts, network requests, secret access, or prompt-injection language. It does instruct assistants to run project-local helper scripts, so users should inspect those scripts before execution.
The workflow recommends running Python entry points located in the target project, but it does not require inspecting them first. A malicious or untrusted repository could place arbitrary code at those paths.
The instructions explicitly name project-local Python entry points and present them as workflow actions. The Markdown does not show their contents or mandate a trust check.
All 32 static findings are false positives or documentation-only references. The skill is readable Markdown and does not contain bundled executable scripts, network requests, secret access, or prompt-injection language. It does instruct assistants to run project-local helper scripts, so users should inspect those scripts before execution.
The workflow recommends running Python entry points located in the target project, but it does not require inspecting them first. A malicious or untrusted repository could place arbitrary code at those paths.
The instructions explicitly name project-local Python entry points and present them as workflow actions. The Markdown does not show their contents or mandate a trust check.
Most static findings are false positives caused by Markdown backticks, Chinese UTF-8 documentation, or security guidance text. No prompt injection, network behavior, secret access, or encoded binary content was found. The remaining concerns are path-scope enforcement in helper scripts and one instruction that can run an unbundled project-local Python entrypoint.
The helper scripts accept --out and --root path parameters and resolve them, but they do not enforce that writes stay under the active project root. An agent following untrusted task text could write a plan or .ai_context file outside the intended repository.
The write paths are directly controlled by CLI parameters and no project-root containment check compares them to the current repository. The issue requires command execution with chosen arguments, so severity is medium rather than high.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs the agent to run a Python project-init entrypoint when context is missing. That script is not bundled here, so execution could run project-local code with filesystem side effects.
Most static findings are false positives caused by Markdown backticks, Chinese UTF-8 documentation, or security guidance text. No prompt injection, network behavior, secret access, or encoded binary content was found. The remaining concerns are path-scope enforcement in helper scripts and one instruction that can run an unbundled project-local Python entrypoint.
The helper scripts accept --out and --root path parameters and resolve them, but they do not enforce that writes stay under the active project root. An agent following untrusted task text could write a plan or .ai_context file outside the intended repository.
The write paths are directly controlled by CLI parameters and no project-root containment check compares them to the current repository. The issue requires command execution with chosen arguments, so severity is medium rather than high.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill instructs the agent to run a Python project-init entrypoint when context is missing. That script is not bundled here, so execution could run project-local code with filesystem side effects.
Static analysis reported many high-risk patterns, but most are false positives from Markdown backticks, documentation examples, Chinese text entropy, and security guidance that mentions secrets. No prompt injection, network exfiltration, shell spawning, or credential access was found. The confirmed risk is local filesystem modification through bundled helper scripts, which is legitimate for this workflow but should be disclosed to users.
The bundled helpers can create .ai_context/03_ACTIVE_TASK.md and write plan output to a user-selected path. This matches the skill purpose, but users should review paths before execution because local files can be created or overwritten.
The scripts directly call mkdir and write_text on paths derived from command-line arguments. This is documented and intentional, but it is still a real local filesystem risk.
The plan helper accepts an --out path and resolves it before writing. Its traversal check is not a strong project-root boundary, so a user-provided absolute path can target locations outside the current repository.
The code shows arbitrary output path support and the security document acknowledges filesystem and sanitization limitations. No malicious intent is evident, so medium risk is appropriate.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Static Shell Execution Matches Are Documentation Examples
The reported Ruby or shell backtick detections are Markdown inline code, fenced examples, or command examples. I did not find code that invokes a shell, subprocess, eval, or dynamic execution.
Manual review found Markdown formatting and local command examples, not executable shell calls inside the scripts. The Python files do not import subprocess or call shell APIs.
Network and Credential Static Matches Are False Positives
The network match is contribution text, and the environment-file match is security guidance warning users not to commit secrets. I did not find network requests or credential reads.
The cited lines are plain documentation and warnings. Source review found no requests, urllib, socket usage, environment variable access, or exfiltration behavior.
High Entropy Heuristics Are Caused by Multilingual Documentation
The high entropy findings occur in Markdown files containing Chinese text, symbols, and examples. No encoded payload, binary blob, or obfuscated code was found in those files.
Manual inspection showed readable Markdown content rather than encrypted or packed data. The heuristic is plausibly triggered by multilingual text and formatting.
Pure prompt-based Claude skill with two local utility scripts. Scripts access local filesystem only within project root with proper path traversal protection. No network calls, no credential access, no external command execution. Minimal security footprint with Python standard library only.
11
Files scanned
699
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Both Python scripts access the local filesystem to create and write files within the project root. append_log.py creates `.ai_context/03_ACTIVE_TASK.md` and appends log entries. plan_helper.py writes plan templates to files. These operations include path traversal protection (lines 76-79 in plan_helper.py, lines 62-75 in append_log.py) and are scoped to the project directory as documented. This is necessary for the skill's purpose of maintaining project context.
Pure prompt-based Claude skill with two local utility scripts. Scripts access local filesystem only within project root with proper path traversal protection. No network calls, no credential access, no external command execution. Minimal security footprint with Python standard library only.
11
Files scanned
699
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Both Python scripts access the local filesystem to create and write files within the project root. append_log.py creates `.ai_context/03_ACTIVE_TASK.md` and appends log entries. plan_helper.py writes plan templates to files. These operations include path traversal protection (lines 76-79 in plan_helper.py, lines 62-75 in append_log.py) and are scoped to the project directory as documented. This is necessary for the skill's purpose of maintaining project context.
Pure prompt-based Claude skill with two local utility scripts. Scripts access local filesystem only within project root with proper path traversal protection. No network calls, no credential access, no external command execution. Minimal security footprint with Python standard library only.
11
Files scanned
699
Lines analyzed
2
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Both Python scripts access the local filesystem to create and write files within the project root. append_log.py creates `.ai_context/03_ACTIVE_TASK.md` and appends log entries. plan_helper.py writes plan templates to files. These operations include path traversal protection (lines 76-79 in plan_helper.py, lines 62-75 in append_log.py) and are scoped to the project directory as documented. This is necessary for the skill's purpose of maintaining project context.