Security audit
Security checks for vulnerabilities and agentic risk
This is a prompt-organizing skill with no code execution, persistence, credential use, or hidden data access.
Before installing, be aware that the skill may activate on broad brainstorming-style phrases and its instructions are mainly Chinese. It is otherwise a low-risk prompt-formatting aid because it only processes user-provided text and does not execute commands or access private data.
The README is primarily written in Chinese, including operational sections such as triggers and templates, while not explicitly stating that users may choose their preferred language. Because the policy requires avoiding forced language or locale constraints without opt-in, this can be interpreted as a language-defaulting issue.
The trigger phrases are broad enough to match common conversational language such as '帮我整理一下' or '我想说的是', which can cause the skill to activate outside the user's intent. In a prompt-rewriting skill, unintended activation can distort the user's request, introduce unnecessary transformation steps, and interfere with safer or more appropriate skills.
The manifest says to use the skill not only on several example phrases, but also whenever the user's message is 'clearly unstructured brainstorming' and for 'any general request.' Those conditions are broad and subjective, which makes it unclear when the skill should or should not activate and increases the risk of unintended invocation.
The skill instructions and user-facing examples are entirely in Chinese, with no indication that the user can choose another language or that the locale restriction is intentional and documented as region-specific. This can violate language/locale policy when applied to users who did not opt into Chinese output.
