Security audit
Security checks for vulnerabilities and agentic risk
This is a text-only image-prompt skill, but it includes under-scoped guidance for bypassing platform content refusals and preserving real-person identity details in generated images.
Review carefully before installing. The skill does not appear to execute code or access local secrets, but it is designed to help rewrite refused image prompts and to preserve or reproduce identity details from reference images. Use it only for authorized, policy-compliant commercial/product imagery, and avoid real-person replication, face swapping, sexualized or age-ambiguous content, or attempts to bypass a platform's safety decision.
The instruction to output a "platform-safe rewrite" when content is blocked is not a neutral compliance step; it is designed to preserve generation intent while reformulating prompts to avoid moderation. That enables users to continue pursuing content a platform already refused, which is a classic moderation-evasion pattern.
These lines explicitly tell the system to avoid high-risk terms in prompts, negative prompts, and add-ons while substituting commercial euphemisms that retain the original sensitive objective. This is dangerous because it operationalizes semantic evasion of moderation systems rather than genuine safety filtering.
The fallback chain explicitly describes iterative desensitization steps to keep weakening a rejected prompt until one version bypasses moderation. This is effectively a playbook for systematically probing and circumventing safety filters, increasing the reliability of unsafe content generation.
The intimate-apparel guidance states that the system may internally preserve the user's sensitive category while externally masking it with safer wording for the image model. In context, this is particularly dangerous because the skill is built to help retain commercial intent for sensitive body-focused imagery while avoiding platform detection.
The document explicitly instructs users to rewrite prompts so they are more likely to pass platform safety review, which is a direct form of moderation-evasion guidance. In the context of an image-prompt optimization skill that specifically mentions sensitive apparel/body-focused use cases, this materially increases the chance that disallowed sexualized or otherwise policy-restricted content will be generated through disguised phrasing.
These sections do not merely sanitize wording; they preserve the original blocked intent while advising the user to avoid high-risk terms in both positive and negative prompts. That is dangerous because it teaches semantic evasion of safety classifiers and enables the generation of content that platform policy was attempting to stop.
The replacement table is a concrete evasion mechanism: it maps sexual/adult terms to innocuous commercial-language substitutes so the same request can survive moderation filters. This is especially risky because it operationalizes bypasses for multiple restricted concepts, including sexualized apparel and age-adjacent terms, making harmful prompt laundering easy to repeat at scale.
The stepwise 'if still rejected' workflow provides iterative desensitization tactics to keep modifying blocked prompts until they are accepted, which is classic gradual moderation bypass guidance. Even where some steps move toward safer outputs, the explicit objective is to retain as much original intent as possible while defeating platform review controls.
The skill advertises very broad trigger conditions such as common user intents for image optimization and even a short token like "ao", which can cause unintended activation during ordinary conversations. Over-broad activation increases the chance that the skill's policy-evasion and impersonation behaviors are invoked without clear user intent, expanding exposure to unsafe outputs.
The Quick Rules section defines many vague defaults like "更完善", "效果更好", and "更全面" that are common in normal prompt-editing requests and can activate complex behaviors automatically. In this file, those defaults are especially risky because they can silently route users into policy-rewrite, strict replication, or sensitive-person depiction workflows without adequate gating.
This markdown guide presents all instructions and operational guidance exclusively in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The entire skill file is written as fixed Chinese prompt text and provides no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.
The guide explicitly instructs the agent to internally preserve lingerie/underwear intent while rewriting outputs into safer-looking terminology and avoiding high-risk words in prompts or negative prompts. In this skill context, that functions as moderation-evasion guidance: it helps generate content that may violate platform sexual-content policies while making detection harder, especially when combined with model-reference preservation and 'strict recreation' workflows.
The file hard-codes portrait prompt templates around specific national or regional identities such as 'Korean', 'Japanese', 'Asian', and 'Western' styles without offering neutral alternatives, user choice, or a documented business need for those constraints. In an image-generation skill, this can steer outputs toward stereotype-based or exclusionary representations and may cause biased or inappropriate personalization when users did not request locale-specific traits.
This file presents the skill instructions in Chinese with parallel English prompt fragments, but it does not state that language selection is optional or user-driven. Under the policy, forcing or assuming a specific language/locale without opt-in can be a natural-language policy violation unless the constraint is clearly justified.
Lines L085-L107 explicitly define a fixed division of labor between Chinese prompts and English prompts, stating that Chinese is for complete decision expression and English is better for model execution. This is a natural-language locale policy constraint that steers output language behavior without indicating that the user may choose their preferred language.
The file's operational instructions and navigation cues are entirely in Chinese, which effectively forces a specific language for users or maintainers reading the skill guidance. There is no indication that this locale restriction is optional, user-selected, or justified as region-specific.
The routing rules and trigger descriptions are very broad, covering common phrases like prompt optimization, realism improvement, image fidelity, and policy-safe generation. In an agent setting, this can cause the skill to activate for loosely related requests and then apply high-risk prompt-shaping behaviors such as strict imitation, policy-evasion phrasing, or sensitive commercial-image generation without clear user intent boundaries.
This markdown section explicitly prescribes that prompts should be written in English and provides only English prompt patterns. That creates a language/locale constraint without any visible user opt-in or alternative-language option, which matches the policy category for forced language choice.
The document prescribes a Chinese-first prompt structure under '中文结构' and generally presents the system behavior entirely in Chinese, with no instruction to ask for or honor the user's preferred language. This creates a natural-language locale policy issue because it imposes a specific language without explicit opt-in or documented region-specific justification.
The instructions say that when the user requests strict reproduction, the response 'must' include both '中文提示词' and 'English Prompt'. This imposes specific output languages by default and does not offer a user opt-in or alternative language choice, which is a natural-language locale policy concern.
This section directs the model to lock onto facial identity features, age/style markers, and detailed intimate-apparel characteristics to achieve '完全参考' or '严格复刻.' That meaningfully increases the ability to recreate real people and sexualized apparel details from uploaded images, crossing from generic description into targeted identity and body-detail replication. In the context of a high-fidelity image reconstruction skill, this raises risks of impersonation, privacy invasion, and non-consensual intimate-image synthesis.
The document explicitly recommends '参考图+换脸' as a way to recover or reproduce a specific person's face. That goes beyond benign prompt optimization and enables identity imitation/deepfake-style generation, especially when paired with the rest of the file's 1:1 reconstruction guidance. In this skill context, that is more dangerous because the skill is designed to reverse-engineer and replicate uploaded reference images with high fidelity.
This markdown file includes required English vocabulary alongside Chinese guidance, and later recommends a fixed output structure that assumes these conventions. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy issue unless clearly justified.
Line L14 says to annotate objects in Chinese, which imposes a specific language requirement in natural-language instructions. The file does not indicate that Chinese is optional or user-selected, so this can conflict with a language/locale choice policy.
