swcr-register
软件著作权登记全流程：从代码仓/目录生成程序鉴别材料（源程序文档）、 软件操作手册、申请填报信息 Markdown，并可辅助在线填报。 当用户需要申请软件著作权、生成软著材料时触发。
71
88%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md Step 2 fetches “GitHub URL” content at runtime (via `git clone`), and Step 3 then reads outsider-provided `README.md` text (generate_form_info.py `extract_functions_from_readme()`), which becomes prompt-relevant free text when later summarized/used in Step 3-C for form fields and shown/confirmed in Step 4.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
SKILL.md explicitly instructs cloning a user-provided GitHub URL at runtime ("如果用户提供的是 GitHub URL：`git clone <url>`"), e.g. https://github.com/user/repo, and the fetched repository/README is parsed and injected into generated materials and form fields, so remote content controls the agent's outputs.
- Repository
- TeamWiseFlow/xiaobei
- Commit
bcef823
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.