Security audit
Html Cn Render Fix
Security checks across malware telemetry and agentic risk
Overview
The skill's requirements, instructions, and included example code align with its stated purpose (fixing Chinese/emoji rendering in matplotlib images); there are no unexplained credentials, network endpoints, or risky install steps.
This skill appears to do what it says: explicitly load CJK-capable fonts for matplotlib to fix Chinese/emoji rendering. Before running anything: 1) Verify the font path(s) match your system (the example assumes /usr/share/fonts/google-noto-cjk/...); 2) Installing fonts via apt/yum/brew requires root/sudo — run those commands only on systems you control; 3) The SKILL.md suggests removing matplotlib cache (~/.cache/matplotlib) which will affect user state — back up if needed; 4) Review example.py before running (it has minor code issues around reusing the plt variable and redundant BytesIO/fig handling — harmless but may raise runtime errors); 5) Run the example in a safe or disposable environment if you are unsure. Overall, there are no hidden network endpoints or credential requests.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings