Security audit
Security checks for vulnerabilities and agentic risk
This is a simple mindmap-generation helper with no evidence of hidden execution, data theft, persistence, or destructive behavior.
Review the broad auto-activation wording and declared Bash/file-editing tools before installing. The inspected package does not show malicious behavior, but users who only want narrow mindmap rendering may prefer tighter trigger wording and clearer limits on when commands or file edits should be used.
The activation criteria are broad enough to trigger on generic visual-content requests, not just narrowly scoped mindmap tasks. This can cause unintended auto-invocation of the skill, increasing the chance that the agent applies inappropriate instructions or tools in unrelated contexts, which is a real security and reliability concern for auto-activating skills.
The manifest presents the skill name and description in Chinese, with no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy expectations when a skill implicitly enforces a specific language without opt-in or justification.
The example triggers use common phrasing like 'help me with' or 'set up' combined with the skill name, which is only moderately specific and may reinforce loose matching behavior. While not directly exploitable on its own, it contributes to accidental invocation and skill misrouting, especially in systems that learn or infer activation behavior from examples.
No suspicious patterns detected.
