What does the skill do, in one sentence?
Vault Audit scans the files on your own UGREEN NAS for exposed passwords, keys, and recovery phrases, and delivers a tiered risk report with a fix plan that runs only with your confirmation.
Who is it for, and what problem do they have?
Home and small-office NAS owners who keep tax records, wallet backups, password exports, and family documents in one place. Credentials quietly accumulate in notes, backups, and screenshots, often duplicated into shared folders, and no built-in tool warns the owner.
What is the solution?
A read-only audit skill. It inventories authorized folders, extracts document and image text, matches it against a secret-pattern catalog, filters false positives with context rules, and scores what survives. The result is a verdict ledger: each finding carries a severity tier, masked evidence, its locations, and one recommended action.
What is the main user flow?
The user requests an audit and confirms the folders. The skill inventories, extracts, matches, triages, and cross-checks sharing exposure, then saves the report. Remediation is separate: the user confirms findings by ID, and only those actions run, through the platform approval flow.
How is it different from existing tools?
Duplicate finders and file organizers never read content for credential risk. Vault Audit combines secret-pattern detection, false-positive triage, duplicate and shared-scope exposure scoring, and a confirmation gate that never deletes and never acts automatically: security audit discipline, not a cleanup utility.
Which AI NAS capabilities does it use, and where?
Published UGOS capabilities only: file listing, finding, category views, metadata, hashes, and duplicate scan (step 1); document extraction (step 2); bounded text reading (step 3); image OCR and album sharing fields (step 4); extended attributes and permission-filtered category views for exposure (step 6); text saving for the report (step 7).
What is the technical approach?
Markdown orchestration only, following the Uliya Skill Development Standard: the skill delegates each stage to the registered file, document, photo, and knowledge experts, and does pattern matching and triage itself against bundled references. Inputs are user-confirmed folders and a report destination. All audit capabilities are read-only; state changes exist only in the gated remediation step. Processing stays on the NAS, reports store masked evidence only, and model choice is left to the platform experts.
What is the current build status?
The skill package is written and passes the official Uliya static checker with zero errors and zero warnings. The workflow has been dry-run locally against a synthetic corpus with planted dummy secrets, duplicate traps, and false-positive traps, and the ledger matched the expected verdicts, including shared-scope escalations.
How will it be validated?
Core case one: a mixed folder with planted dummy secrets and duplicates must produce the expected Critical and High rows and change nothing. Core case two: a trap folder of essays and labeled examples must produce zero findings. Edge case: an unreadable subfolder plus a recovery phrase in a shared album must yield a partial report with the shared-scope escalation.
What are the limitations, risks, and dependencies?
The published capability catalog offers no per-file permission listing, no share-link enumeration, and no user-account or system-log access, so permission coverage is partial and link exposure is uncovered; every report states this. Encrypted or unsupported files are reported as unexamined, never as clean. It depends only on the published catalog and standard expert agents.
Third-party licenses
The skill package is original work written for this hackathon. It contains no third-party code, scripts, or binaries. Development used the official UGREEN Skill Developer Package / Starter Kit (uliya-skill-kit 0.7.3, including capability catalog 2.0.0) as the required basis, per the event instructions. AI assistance disclosure: the skill's Markdown was authored with the help of an AI assistant (Muse), as contemplated by the Starter Kit guide. Test fixtures use publicly documented dummy example values only; no real credentials appear anywhere in the submission.
Built With
- markdown
- ugreen
