Security audit
Security checks for vulnerabilities and agentic risk
The package includes a local WeChat article formatter, but its instructions also cover web search, AI image work, WeChat account secrets, uploads, and draft publishing while claiming no network or credentials.
Review this before installing if you only wanted a local formatter. Use it only with explicit limits: run the local Python formatter for Markdown-to-HTML conversion, do not provide WeChat app secrets, and do not allow web search, uploads, draft creation, or account switching unless you intentionally want those publishing capabilities and approve each action.
The documented behavior is internally inconsistent: it markets itself as a local formatter, but also describes writing, search, image generation, and embed-card behavior not cleanly represented in the stated scope. Description-behavior mismatches are dangerous because users and orchestrators may grant trust or permissions based on the benign description while the skill steers into broader actions.
The trigger phrases are broad enough to match common writing and editing requests, increasing the chance that the skill activates outside its narrow intended purpose. Overbroad routing is risky here because the skill text contains expanded workflows that include search, generation, and publishing guidance.
The file explicitly claims 'zero network, zero credentials' but later documents network search and credential-based WeChat account and publishing operations. This contradiction can mislead users and safety systems into treating the skill as low risk when it actually includes high-trust workflows.
The skill document broadens from local Markdown formatting into article writing, web search, image generation, and WeChat publishing. This is a scope-creep vulnerability because a seemingly harmless formatting skill can become a gateway to higher-risk actions, including external communication and content publication.
Including credentialed account management and draft/material publishing instructions in a formatting skill is unsafe because it normalizes access to secrets and outbound publication under an unrelated feature banner. If an agent follows these instructions, it could handle credentials or publish content without the user appreciating that this formatter has escalated into account operations.
The skill does not declare a restrictive tool scope, yet the documentation instructs reading and writing files and later expands into networked and credentialed operations. In an agent environment, missing explicit scope makes it easier for the skill to be invoked with broader capabilities than users would reasonably expect.
The condition 'when the user asks to write a WeChat article' is too broad for a skill whose safe core is local formatting. Ambiguous activation can route general writing tasks into a skill that also documents network search, image generation, and publication, increasing the chance of unintended higher-risk actions.
The file mandates a fixed “刘润风” writing style as part of the skill’s writing behavior, without indicating that users can choose another language/style preference. This is a natural-language policy concern because it imposes a specific stylistic/locale choice by default rather than offering opt-in or alternatives.
This manifest uses Chinese for the display name and all usage guidance, which can impose a language requirement on users or downstream editors without any opt-in or justification. Under the policy, forcing a specific language is a natural-language policy concern unless the locale constraint is explicit and justified.
The skill’s display name and all user-facing guidance are written entirely in Chinese, with no indication that language selection is optional or limited to a justified region-specific context. This can violate language/locale policy because it effectively constrains use to a single language without offering user choice.
This manifest uses Chinese for the display name and all user-facing descriptive fields, but it does not document that the skill is Chinese-only or offer any language/locale choice. That can violate language/locale policy when users or systems expect locale-neutral or user-selectable behavior.
This file uses Chinese for the display name, usage guidance, anti-patterns, and example content, which effectively forces a specific language/locale for users or downstream maintainers. The policy allows locale constraints only when they are explicitly justified or when users are given a language choice, neither of which appears here.
The description at L05 forces a specific language/locale presentation without any indication that users can choose another language. Under the policy, language constraints should be optional or clearly justified; this manifest provides neither.
The manifest requests shell access for a skill whose stated purpose is article formatting and HTML conversion, which does not inherently require command execution. Unnecessary shell capability materially increases the attack surface because prompt-controlled or content-driven workflows could invoke OS commands, leading to arbitrary command execution, data access, or environment compromise.
The display name is specified only in Chinese ("要点清单"), which indicates a fixed language choice in user-facing text. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy concern.
The entire skill documentation is presented only in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
The file uses Chinese-only natural-language values for the theme name and description. Because this is a general theme preset rather than a clearly region-specific artifact, forcing a single language without opt-in can violate language/locale policy expectations.
The file uses Chinese-only natural-language values for the theme name and description. Because this is a generic theme preset rather than an explicitly region-specific artifact, the file imposes a specific language with no opt-in or alternative locale support, which matches the language/locale policy concern.
This manifest file contains natural-language fields for the theme name and description exclusively in Chinese. Because the file does not indicate that the theme is region-specific or provide an opt-in language choice, it may violate a language/locale policy requiring user choice or documented justification.
This YAML theme file uses Chinese-only naming and descriptive text such as the skill name and description, which indicates a fixed language/locale choice. The file does not offer any user opt-in or explain that the preset is intentionally region- or language-specific, so it may conflict with language-choice policy expectations.
The theme name, description, and font stack explicitly target Chinese typography, including 'Songti SC' and 'Noto Serif CJK SC', indicating a fixed language/locale preference. The file does not offer any language choice or explain that this preset is intentionally region-specific, which can conflict with language/locale policy requirements.
No suspicious patterns detected.
