lovstudio-fill-web-form — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited lovstudio-fill-web-form (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Fetch a web form, extract all fields, deep-search the user's local knowledge base for matching information, and output a ready-to-use markdown document.
Use WebFetch to retrieve the form page and extract ALL fields:
WebFetch(url, prompt="Extract ALL form fields. For each field list: label,
type (text/textarea/select/radio/checkbox/file), required status, options
if applicable, min length constraints. Return structured list.")If the form has radio/select fields, make a second WebFetch call to get the exact option text for each.
Launch an Agent (subagent_type: Explore, thoroughness: very thorough) to search the user's knowledge base. The agent prompt MUST include:
**/profile/**, **/about/**, **/bio/**)official.md, awards.md, resume filesRun this in parallel with any additional WebFetch calls from Step 1.
For each form field, synthesize the best answer from search results:
| Field Type | Strategy |
|---|---|
| Short text (name, company, city) | Direct extraction from profile |
| Bio/introduction (min chars) | Compose from official bio, expand to meet minimum |
| Long-form (case background, solution) | Synthesize from articles, projects, talks |
| Radio/select | Pick the best-matching option based on profile |
| File upload | Mark as "needs manual upload" with specs |
| Private (phone, email) | Mark as "needs manual input", suggest if found |
If required fields remain unknown after local search, use AskUserQuestion to collect only those missing values. Do not ask for fields already inferred from context.
Write a markdown document with ALL form fields filled. Format:
---
title: "<Form Name> - 填写内容"
status: draft
---
# <Form Name>
> 表单地址:<URL>
---
## 1. <Field Label>
<Filled content or instruction>
---
## 2. <Field Label>
...Rules:
**✅ 选择:**> ⚠️ 需上传:<specs>> ⚠️ 需手动填写(with suggestion if available)with a tree of all files that were read/searched during knowledge base retrieval:
---
## 附录:检索文件路径
knowledge-base/ ├── profile/ │ └── official.md ← 个人简介 ├── posts/standalone/2025/ │ ├── 07-10-Vol-51...md ← 演讲经历 │ └── 06-25-comate...md ← AI工具评测 ├── 1-Projects/lovpen/ │ └── ... ← 产品信息 └── CLAUDE.md ← 项目上下文
This tree helps the user verify source coverage and spot missing materials.
Output naming: Follow user's naming convention. Default: 手工川-<form-topic>-<YYYY-MM-DD>-v0.1.md
After writing the file, show:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.