Security audit
Security checks for vulnerabilities and agentic risk
This is a small confirmation-handler skill that uses temporary marker files for a design workflow, with no evidence of hidden code, exfiltration, persistence, or privilege escalation.
Install this only if you are using the related design-framework suite and are comfortable with Chinese trigger phrases. In group chats, consider narrowing confirmation phrases so casual replies like ok do not accidentally confirm a pending preview.
The skill treats broad everyday replies such as “好的”, “ok”, “可以”, and “行” as confirmation commands. In a group or multi-turn context, these generic acknowledgements can easily appear in unrelated conversation or in response to something else, causing unintended state changes such as marking a design task confirmed and triggering downstream generation.
The manifest description is written entirely in Chinese and describes the skill’s behavior without any indication that language is configurable or limited to a justified region-specific use case. This can reflect a language/locale policy issue because it implies the skill is targeted to a single language without user opt-in.
The entire skill description and user-facing command vocabulary are specified only in Chinese, with no indication that the user can choose another language or locale. This can constitute a language policy issue when the skill behavior is constrained to one language without explicit opt-in or documented justification.
No suspicious patterns detected.
