Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small, disclosed WeChat article-generation helper with no evidence of hidden access, persistence, destructive behavior, or data exfiltration.
Install only if you want a Chinese/WeChat-focused writing helper. Be aware that the package declares requests and openai dependencies, so future or fuller versions may need network/API access for real AI generation, but the inspected version does not show hidden or unsafe behavior.
The natural-language content of the skill is presented only in Chinese, and the file does not indicate that the skill is region-specific or that users can opt into this language. Under the stated policy, forcing a specific language without user choice can be a locale-policy violation.
The skill name and description are explicitly tied to the Chinese/WeChat ecosystem, which suggests a locale-specific experience. Because the manifest does not indicate that users can choose language/locale or that the regional constraint is intentional and documented, this may violate language/locale policy requirements.
This is a manifest file, so vague-trigger review applies. The description broadly advertises an 'AI WeChat public account article auto-generation tool' with 'one-click' article generation and optimization, but provides no specific activation phrases, scope limits, or exclusion conditions, which could make invocation matching overly broad in systems that rely on manifest descriptions.
The natural-language description and function docstring indicate the skill is specifically a WeChat public-account article generator written for Chinese output, with no indication that users can choose another language or locale. This creates a language/locale constraint without user opt-in, which matches the policy-violation category for natural-language restrictions.
No suspicious patterns detected.
