Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese fairy-tale and podcast-generation skill with no evidence of hidden code, persistence, or unrelated data access.
Install this if you want a Chinese-language Shan Hai Jing children's story generator that also creates podcast audio. Be aware it may generate playable audio as part of normal use, and users who need another language or a different target age should specify that explicitly.
The skill enforces a Chinese-language experience throughout without offering language choice, which can cause users to receive output they cannot understand or did not request. This is primarily a usability and consent issue rather than a classic exploit, but it can still reduce transparency around generated content and audio behavior.
The manifest text specifies the skill entirely in Chinese and describes a Chinese-language storytelling experience without indicating that users may choose another language. This can violate language/locale policy when no user opt-in or language choice is offered.
The skill instructs the agent to generate podcast audio asynchronously, but the description does not clearly warn users up front that audio will be created and played as part of normal operation. This can surprise users, especially in quiet/shared environments or when they did not expect media generation, though it does not by itself create a direct security compromise.
This manifest describes what the skill does, but it does not define any specific invocation phrases, scope limits, or exclusion conditions. In a manifest file, that lack of trigger specificity can make activation boundaries ambiguous and increase the chance of unintended invocation.
