技能 un-editorial-check

📦

un-editorial-check

Name: un-editorial-check
Author: ahaomar

v1.7.0 內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取🔑 環境變數🌐 網路存取⚡ 包含腳本

Review Copy Against UN Editorial Rules

Editorial inconsistencies and sensitive wording are difficult to track across documents and websites. This skill checks extracted English copy and separates rule violations from human review.

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "un-editorial-check" from https://skillstore.io/skills/ahaomar-un-editorial-check.md and its manifest at https://skillstore.io/api/skills/ahaomar-un-editorial-check/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/ahaomar-un-editorial-check.md 已簽名 manifest GET /api/skills/ahaomar-un-editorial-check/manifest 已簽名 lockfile GET /api/skills/ahaomar-un-editorial-check/lockfile

測試它

正在使用「un-editorial-check」。 Draft text: The color of the cover was noted.

預期結果:

Deterministic spelling finding: color.
Suggested wording: colour.
The checker reports the matching rule and source. The draft remains unchanged until an approved fix is applied.

正在使用「un-editorial-check」。 An image-only PDF with no recoverable text.

預期結果:

Extraction refused: the document appears to contain scanned images without extractable text.
The run returns exit code 2. The document is not reported as checked or clean.

正在使用「un-editorial-check」。 A claim-register entry contains a source but no reference date.

預期結果:

Human review required: record the reference date for the registered claim.
Register completeness does not establish that the claim is true.

安全審計

高風險

v1 • 2026/10/2 開啟版本化報告

Of 400 supplied findings, 394 are false positives; six confirm unsafe baseline creation or blocking special-file reads, with additional PDF denial-of-service risk. No evidence found of prompt injection or intentional data exfiltration in reviewed context. Review was capped at 400 of 5,037 matches; the remaining 4,637 require manual review before automatic publication. Static review was capped at 400/5037 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

251

已掃描檔案

41,276

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

高

lib/pdf-parse.mjs:815-860 lib/pdf-parse.mjs:871-890 SECURITY.md:25

Unbounded PDF Parsing Can Exhaust Resources

PDF filter chains decompress synchronously without a decoded-byte budget or execution deadline. A hostile document can exhaust memory or block an agent or CI process.

The inflate calls omit maxOutputLength, and the filter chain has no cumulative decoded-byte budget. The security policy explicitly acknowledges unsandboxed denial-of-service exposure.

能力複核項目 (6)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

中

lib/baseline.mjs:111

Node.js fs operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

中

lib/baseline.mjs:162

Node.js fs operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

中

lib/claims.mjs:95

Node.js fs operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

中

lib/baseline.mjs:111

Synchronous file operations

text = fs.readFileSync(file, 'utf8');

Baseline input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

中

lib/baseline.mjs:162

Synchronous file operations

fs.writeFileSync(target, serialiseSnapshot(built));

A dangling baseline symlink makes the read return ENOENT, after which writeFileSync follows the link. An attacker can redirect creation outside the intended path.

中

lib/claims.mjs:95

Synchronous file operations

raw = parseJsonStrict(fs.readFileSync(file, 'utf8'), file);

Claim-register input is read synchronously without checking file type. An attacker-controlled FIFO at the requested path can block the checker indefinitely.

風險因素

⚙️ 外部命令 (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:25 .github/workflows/ci.yml:37 .github/workflows/ci.yml:38 docs/npm-metadata.md:199 lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/audits.mjs:62 lib/audits.mjs:67 lib/audits.mjs:80 lib/audits.mjs:95 lib/audits.mjs:103 lib/audits.mjs:109 lib/audits.mjs:144 lib/audits.mjs:146 lib/audits.mjs:157 lib/audits.mjs:194 lib/audits.mjs:248 lib/baseline.mjs:1 lib/baseline.mjs:5 lib/baseline.mjs:34 lib/baseline.mjs:46 lib/baseline.mjs:48 lib/baseline.mjs:75 lib/baseline.mjs:84 lib/baseline.mjs:86 lib/baseline.mjs:89 lib/baseline.mjs:91 lib/baseline.mjs:94 lib/baseline.mjs:105 lib/baseline.mjs:114 lib/baseline.mjs:140 lib/baseline.mjs:164 lib/baseline.mjs:170 lib/baseline.mjs:179 lib/baseline.mjs:181 lib/baseline.mjs:182 lib/baseline.mjs:183 lib/claims.mjs:7 lib/claims.mjs:12 lib/claims.mjs:50 lib/claims.mjs:52 lib/claims.mjs:56

📁 檔案系統存取 (50)

.github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:32 .github/workflows/ci.yml:40 .github/workflows/ci.yml:38 action/main.mjs:7 bin/check.mjs:20 bin/check.mjs:8 bin/check.mjs:9 CHANGELOG.md:47 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 COMPATIBILITY.md:23 COMPATIBILITY.md:24 COMPATIBILITY.md:25 COMPATIBILITY.md:26 COMPATIBILITY.md:27 COMPATIBILITY.md:28 COMPATIBILITY.md:29 COMPATIBILITY.md:30 COMPATIBILITY.md:31 COMPATIBILITY.md:32 docs/demo/README.md:103 docs/demo/README.md:104 docs/demo/README.md:105 docs/demo/README.md:106 docs/demo/README.md:93 docs/demo/README.md:94 docs/demo/README.md:95 docs/GLOSSARY-AND-WATCH.md:281 docs/GLOSSARY-AND-WATCH.md:282 docs/GLOSSARY-AND-WATCH.md:287 docs/GLOSSARY-AND-WATCH.md:296 docs/LAUNCH-1.2.0.md:72 docs/LAUNCH-1.2.0.md:75 docs/LAUNCH.md:34 docs/LAUNCH.md:81 docs/LAUNCH.md:96 docs/LAUNCH.md:97 docs/LAUNCH.md:98 docs/LAUNCH.md:102 docs/MIGRATION.md:3

🔑 環境變數 (12)

action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 action/main.mjs:9 action/main.mjs:13 action/main.mjs:14 action/main.mjs:15 tests/audit-adoption.mjs:506 tests/audit-adoption.mjs:515 tests/audit-adoption.mjs:521 tests/fixtures/negative/hs-legal-individuals.txt:3

🌐 網路存取 (50)

COMPATIBILITY.md:40 COMPATIBILITY.md:41 COMPATIBILITY.md:42 COMPATIBILITY.md:43 COMPATIBILITY.md:44 COMPATIBILITY.md:45 COMPATIBILITY.md:46 COMPATIBILITY.md:47 COMPATIBILITY.md:48 COMPATIBILITY.md:49 config/example.un-editorial.json:7 config/profiles/generic-british-english.json:4 config/profiles/un-geneva-web.json:4 config/profiles/un-v1.json:4 docs/npm-metadata.md:188 lib/audits.mjs:157 lib/cli.mjs:41 lib/fetch.mjs:58 lib/init.mjs:161 lib/output.mjs:401 lib/rules-hs.mjs:43 lib/rules-hs.mjs:68 lib/rules-hs.mjs:99 lib/rules-hs.mjs:138 package.json:62 package.json:64 package.json:66 README.md:122 README.md:131 README.md:135 README.md:139 README.md:143 README.md:147 README.md:148 README.md:149 README.md:150 README.md:151 README.md:163 README.md:186 README.md:207 README.md:222 README.md:249 README.md:379 README.md:564 README.md:585 README.md:586 README.md:682 rules/sources.json:9 rules/sources.json:18 rules/sources.json:25

⚡ 包含腳本 (50)

lib/audits.mjs:45 lib/audits.mjs:125 lib/audits.mjs:132 lib/audits.mjs:139 lib/audits.mjs:192 lib/audits.mjs:198 lib/audits.mjs:209 lib/audits.mjs:218 lib/extract-html.mjs:113 lib/extract-js.mjs:214 lib/extract-js.mjs:232 lib/furniture.mjs:66 lib/furniture.mjs:96 lib/furniture.mjs:165 lib/icons.mjs:166 lib/office.mjs:192 lib/office.mjs:246 lib/pdf-extract.mjs:157 lib/pdf-parse.mjs:973 lib/pdf-parse.mjs:992 lib/pdf-parse.mjs:1002 lib/pdf-parse.mjs:1225 lib/pdf-parse.mjs:1296 lib/pdf-text.mjs:190 lib/pdf.mjs:111 lib/pdf.mjs:310 lib/pdf.mjs:515 lib/rules-grammar.mjs:77 lib/rules-grammar.mjs:114 lib/rules-grammar.mjs:151 lib/rules-hs.mjs:285 lib/rules-hs.mjs:295 lib/rules-hs.mjs:322 lib/rules-hs.mjs:336 lib/rules-hs.mjs:353 lib/rules-hs.mjs:394 lib/rules-hs.mjs:408 lib/rules-hs.mjs:425 lib/rules-hs.mjs:427 lib/rules-hs.mjs:489 lib/rules-tone.mjs:42 lib/rules-tone.mjs:64 lib/rules-tone.mjs:99 lib/rules.mjs:201 lib/rules.mjs:247 lib/rules.mjs:250 lib/rules.mjs:267 lib/rules.mjs:342 lib/rules.mjs:392 lib/rules.mjs:411

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg)](https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/ahaomar-un-editorial-check?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ahaomar-un-editorial-check/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/ahaomar-un-editorial-check.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

ahaomar. (2026). un-editorial-check security audit report (audit version 1) [Author version 1.7.0]. Skillstore. https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1

BibTeX 引用

@techreport{ahaomar-ahaomar-un-editorial-check-2026,
  author = {ahaomar},
  title = {un-editorial-check security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1},
  note = {Author version 1.7.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "un-editorial-check security audit report (audit version 1)"
version: "1.7.0"
type: report
authors:
  - name: "ahaomar"
date-released: "2026-10-02"
url: "https://skillstore.io/skills/ahaomar-un-editorial-check/audits/1"
identifiers:
  - type: other
    value: "skillstore:ahaomar-un-editorial-check:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

100

規範符合度

你可以打造什麼

Review Institutional Publications

Check briefing papers for spelling, dates, terminology, and sensitive wording while preserving source references for editorial decisions.

Check Product Interface Copy

Review visible HTML and supported JavaScript copy before release, with optional publishing or accessibility findings reported separately.

Track Evidence Review

Create a claim register for detected figures and comparisons, then check source and reference-date completeness after human review.

試試這些提示

Review One Draft

Review [draft.md] with un-editorial-check. Report deterministic violations separately from findings requiring human review. Do not modify the file.

Prepare an Editorial Report

Check [document.pdf] and write an HTML review report to [report.html]. Preserve rule sources and PDF page references. State extraction refusals clearly.

Preview Approved Corrections

Show the target files in [content-directory]. Preview deterministic fixes for eligible prose files. Request approval before applying changes, then review the resulting diff.

Integrate Evidence and Baseline Checks

Check [content-directory] using [organization-profile.json] and [claims.json]. Compare [baseline.json] and export SARIF. Keep optional audit findings separate from editorial failures.

最佳實務

Keep rule sources, confidence labels, and human-review recommendations attached to each finding.
Show target files and preview corrections before approving writes; review every resulting diff.
Use isolated, resource-limited processing for untrusted documents and review every extraction refusal.

避免

Treating a clean run as factual verification, legal clearance, or United Nations approval.
Automatically rewriting sensitive terminology, claims, or diplomatic language from heuristic findings.
Using watch mode in CI or relying on optional audit findings to determine the process exit code.

常見問題

Which assistants can use this skill?

The portable skill supports Claude, Codex, and Claude Code where the host can load skills and run Node.js 18 or later.

Does it verify facts or provide United Nations approval?

No. It checks documented local rules and identifies review needs. It does not verify claims or represent United Nations endorsement.

Which files can it review?

It reads HTML, Markdown, plain text, supported JavaScript copy, recoverable PDF text, and Word or OpenDocument body text.

Will it rewrite my documents automatically?

No. Fix mode previews changes. Applying approved corrections requires an additional option and is limited to eligible Markdown and plain-text files.

Does it retrieve pages or upload my documents?

It retrieves explicitly supplied HTTP(S) pages and follows redirects. The reviewed retrieval code sends no document body or environment secrets.

What do exit codes mean?

Normally, 0 means no editorial errors, 1 means editorial errors, and 2 means failure. Baseline mode can accept existing errors; optional audits never fail.