Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese/Hong Kong social-media template pack with no executable code, though its marketing overstates automation features it does not implement.
Install this only if you want Chinese/Hong Kong-focused social-media templates. Do not assume it can safely schedule, publish, analyze, or reply on your accounts; require separate explicit approval and platform permissions before allowing any agent to post or respond publicly.
The file is entirely framed as a Chinese tweet generator, including the title '中文推文生成', Chinese-only templates, and '热门中文标签'. This natural-language instruction enforces a specific language/locale without offering the user an option to choose another language, which matches the policy-violation criteria.
This markdown skill file presents all instructions, examples, and output guidance exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no choice or justification is provided.
This plain-text template is entirely framed as Chinese-language hashtags, beginning with a Chinese-only heading and containing only Chinese tags and locale-specific variants. Because the content hardcodes a specific language/locale and provides no indication of optionality or user selection, it constitutes a natural-language locale policy issue under the stated rules.
The file is written as broad marketing copy and does not describe when the skill should activate, what inputs it expects, or what boundaries apply. In agent ecosystems, vague activation and unconstrained positioning can cause overbroad selection or misuse, especially when paired with claims of automation across social platforms.
The skill copy emphasizes Chinese/Cantonese/Traditional Chinese generation without indicating that language selection is user-driven. While not directly exploitable on its own, this can lead to unwanted behavior, reduced user control, and incorrect assumptions by an orchestrating agent about mandated output language.
The promotional text claims capabilities such as automated scheduling, analytics monitoring, and automatic comment replies across multiple platforms, which materially exceed the stated scope of a content-guidance skill. This can mislead users and downstream agents into invoking or trusting automation behaviors that are not clearly declared, reviewed, or constrained, increasing the risk of unauthorized actions or scope creep.
This markdown file contains user-facing instructions exclusively in Chinese, and nowhere indicates that the user can choose another language or that the template is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy violation.
The manifest describes the skill as providing content creation templates and strategies for 小红书、抖音、微信公众号, but this file's calendar repeatedly plans content for X and once for Instagram. That is a semantic mismatch between the declared platform focus and the actual guidance content provided by the skill.
This markdown file includes preset reply text in both Chinese and English, such as the X/Twitter replies, but does not state when each language should be used or whether the user can opt in to a preferred language. That can create a language-policy issue if the skill applies responses automatically in a language the user did not choose.
This plain-text template forces a specific language/locale for generated content through its headings and prompt scaffolding. The file does not indicate that Chinese is optional, user-selected, or required for a justified region-specific use case.
No suspicious patterns detected.
