Find Skills · Risk Assessment Edition

The Problem: Risk in Skill Discovery

When a user needs a skill for a task (like "automate weekly reports"), the challenge isn't finding options, but evaluating them. On platforms like SkillHub, the vast majority of tools lack transparency regarding their permission scope, privacy trajectory, and potential security risks. Installing an unverified skill can introduce backdoors, data leaks, or system instability.

Core Capability: Search, Assessment, and Decision Support

This skill (@laoxi/zhaojineng) provides a comprehensive workflow that deeply integrates skill discovery with independent security assessment. Its core is a built-in cli tool (built on the Python 3 standard library), functioning not as a mere search engine, but as a risk-filtered decision-support tool.

Key Steps & Capabilities:

1. Intelligent Intent Parsing: Extracts the task, domain tag (mapped to a category), and multiple keywords from user natural language, including synonyms, to improve search relevance.
2. Security-First Aggregated Search: The CLI tool queries the SkillHub public API and the assessment data from "Zhuangqiancha" (zhuangqiancha.com) concurrently. It automatically deduplicates, cross-validates, and most critically, ranks results by security tier (🟢🟡🟠🔴⚪), prioritizing the visibility of risk.
3. Context-Aware Intent Matching: Further filters and ranks the initial CLI output based on name and purpose description to select the 3-5 most relevant matches. Supports flags like --safe-only to recommend only 🟢/🟡 tools, or --free-only for tools requiring no API keys.
4. Transparent Risk Decision Path: Mandatory display of security tier and key risk signals with recommendations. For 🟠 (Caution) / 🔴 (High Risk) tools, it explicitly prompts users and requires a secondary confirmation via the inspect command to view full evidence before installation. All assessments are based on public code and declarations.

Scope and Important Caveats

Applicable Scenarios:
- Quickly assessing the security of a batch of potential skill candidates.
- Situations requiring caution with third-party tools, where understanding permissions and privacy risks is a priority.
- Filtering based on specific task categories (e.g., office-efficiency) and security preferences (e.g., free-only or safe-only).

Important Caveats:
- Dependence on Public Data: Search and assessment rely entirely on the SkillHub public API and the independent evaluation database of Zhuangqiancha; no private data is involved.
- Assessment is Not a Guarantee: Security tiers (especially 🟢 "No Risk Found") are conclusions from a current public rule scan, not a manual audit or a guarantee of absolute safety. Terms like "No Risk Found" should be understood as "no known risk signals detected under current rules."
- Unindexed Tools (⚪) - Risk is User-Borne: For tools not indexed by Zhuangqiancha, the CLI clearly marks them as "No independent security assessment available." Their safety is entirely the user's judgment to bear.
- Text-Only Output: The skill is designed for interactive text guidance and does not generate or rely on any images or cards for result display, ensuring direct and clear information.
- Evidence-Based: For high-risk tools, specific evidence (e.g., suspicious code patterns or documented claims) from Zhuangqiancha must be shown. No excessive speculation is made without evidence.