Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese WeChat image-card generator whose bundled scripts only create local image files, with minor caution around broad triggers and an optional publishing step.
Installers should treat this as a local card-generation skill. Before using any optional WeChat push workflow, confirm the target account, review the rendered cards, and require an explicit publish confirmation. Users may also want to edit the hardcoded output path in the deep example script before running it.
The trigger list includes very broad everyday terms such as “贴图” and “卡片”, which can cause the skill to activate in unrelated conversations. Mis-triggering is risky because this skill can lead users into running local scripts and optionally publishing content workflows, so accidental invocation can cause unintended actions or confusion.
The skill mentions an optional step to push content using scripts under .wechat-mp/ but does not clearly warn that this may publish material to an external public platform. In context, this increases the chance of accidental external dissemination of content, especially if the skill is invoked unintentionally or used by someone unaware of the publication consequence.
The file generates all card text in Chinese and includes no indication that language is configurable or that the skill is intentionally limited to a Chinese-only audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
This code embeds user-facing card titles and text in a single language throughout the file, beginning with the module description and continuing in all rendered content. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is explicitly justified.
This file contains user-facing natural-language instructions exclusively in Chinese, and there is no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific workflow. Under the language/locale policy, forcing a single language without opt-in can be a policy violation.
No suspicious patterns detected.
