Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese WeChat Markdown renderer with local file outputs and no hidden credential, persistence, shell, or default network behavior.
Install this if you want a Chinese WeChat Markdown rendering workflow. Use it on Markdown you trust, avoid --no-check unless you intentionally want to bypass self-check output, and do not enable OIMD_REMOTE_TEMPLATE=1 or pass arbitrary HTML to parity-check unless you accept that jsdom will execute that template script.
Referenced artifact was not completely inspected
- **结构合规**：本 skill 即 Claude Agent Skills 通用规范布局（`SKILL.md` + `scripts/` + `references/` + `tests/`），frontmatter 仅用通用字段（name / description / license / metadata）—
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
'--meta': v => { args.meta = v; },
};
const BOOL = { // 布尔开关：不消费后续参数
'--quiet': () => { args.quiet = true; }, '--no-check': () => { args.noCheck = true; },
};
for (let i = 2; i < argv.length; i++) {
const a = argv[i];
Without declared permissions the skill's intent is opaque and cannot be validated.
The description states the skill is for the Chinese WeChat public-account scenario and that output will be in Simplified Chinese. This is a language/locale restriction expressed in natural language, and the file does not present it as a user choice or opt-in at that point.
The metadata explicitly sets locale: zh-CN and says the product definition is Chinese output. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly offered as a choice.
The visible metadata and document content are entirely in Chinese, including the title and descriptive subtitle, with no indication that users may select another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific.
No suspicious patterns detected.