Initial commit with translated description

This commit is contained in:
2026-03-29 10:17:24 +08:00
commit 2fa8b37b66
66 changed files with 8820 additions and 0 deletions

43
SECURITY_NOTE.md Normal file
View File

@@ -0,0 +1,43 @@
# Security Note — AI Persona OS
Some automated security scanners (e.g. VirusTotal Code Insight) may flag this skill due to heuristic pattern matching. This document explains why those flags are **false positives**.
## What scanners detect vs. what the code actually does
### "Crypto key handling patterns"
- **Trigger:** `scripts/security-audit.sh` contains regex patterns like `api_key`, `secret_key`, `access_token`, etc.
- **Reality:** This script *searches your workspace for accidentally leaked credentials*. It does not store, transmit, or handle any secrets. All checks are local `grep` scans with no network calls.
- **Trigger:** `examples/coding-assistant/KNOWLEDGE.md` references environment variable names like `YOUR_API_KEY` and `DATABASE_URL`.
- **Reality:** These are placeholder names in a documentation template — no actual credentials are present.
### "External API calls"
- **Trigger:** Code examples in `examples/coding-assistant/KNOWLEDGE.md` show a TypeScript `fetch()` pattern.
- **Reality:** This is an illustrative code snippet (`/api/endpoint` is not a real URL). No files in this skill make any network requests.
- **Trigger:** URLs to `jeffjhunter.com` and `aimoneygroup.com` appear in attribution footers.
- **Reality:** These are the author's homepage links in documentation — not API endpoints.
### "Eval or dynamic code execution"
- **Trigger:** Words like "execute," "execution," and "execute commands" appear frequently in documentation.
- **Reality:** These describe the *concept* of AI agent task execution within the persona framework. There are **zero** `eval()`, `exec()`, or dynamic code execution calls in any script.
## Verification
You can verify this yourself:
```bash
# Confirm no eval/exec calls exist
grep -rn "eval\|exec(" scripts/ --include="*.sh"
# Confirm no network calls exist in scripts
grep -rn "curl\|wget\|nc \|netcat\|/dev/tcp" scripts/ --include="*.sh"
# Review the security audit script directly
cat scripts/security-audit.sh
```
## Questions?
If you have security concerns, please open an issue or contact the author directly.
- **Author:** Jeff J Hunter
- **Website:** https://jeffjhunter.com