Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local 3D word-cloud generator, with the main caveat that its generated browser page uses disclosed public CDN scripts.
Reasonable to install if you want a browser-based 3D word-cloud tool. For sensitive conversation exports, prefer bundling local copies of the JavaScript dependencies or using the tool offline after verifying cached dependencies, because the generated page relies on public CDN scripts.
描述中强调“自动中文分词”，后文还要求“UTF-8-sig（带 BOM）”以避免中文乱码，并给出中文停用词表，整体默认以中文语料为唯一目标，但未说明这是仅适用于中文场景的技能，也未向用户提供语言选择。这会构成语言/locale 层面的隐性强制，不符合需要显式选择或清晰限定的要求。
该技能的触发条件使用了“将对话历史可视化”“分析文本关键词分布”“创建交互式数据可视化”等宽泛表述，但没有限定必须是词云、3D 地球可视化或特定文件处理场景。这类描述容易覆盖常见的数据分析或可视化请求，缺少排除条件和负例，增加误触发风险。
The skill claims that data stays local and that there are no external calls, but the documented implementation loads Three.js, OrbitControls, and segmentit from public CDNs. This creates a supply-chain and privacy boundary issue: opening the generated HTML causes network requests to third parties, which can leak metadata and execute remotely hosted JavaScript in the browser.
The document states that all code is contained in a single HTML file, yet the implementation depends on externally hosted scripts. This can mislead users into trusting the artifact as self-contained when it actually executes remote code on first load, weakening informed consent and increasing exposure to CDN compromise or unexpected script changes.
No suspicious patterns detected.
