Security audit
Security checks for vulnerabilities and agentic risk
This is a photography guidance skill with no executable code, persistence, credential use, or hidden side effects.
Installers should expect a Chinese-first photography education skill. It appears safe from a security perspective, but users who want multilingual responses may need clearer locale guidance from the publisher.
All prompts, expected behaviors, and notes are written exclusively in Chinese, and there is no indication that the skill supports user language choice or that it is intentionally limited to a Chinese-only audience. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
This JSON test file is a manifest-style file, so SQP-1 applies. The should-trigger case uses a broad question about 'basic principles' and 'how to judge whether a photo is good' without clearly defining the full trigger boundary, which can overlap with many general photography-help requests; although there are some negative examples, the activation scope still remains somewhat underspecified.
No suspicious patterns detected.
