Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward WeChat theme CSS generator with disclosed local file output and no executable or hidden behavior.
Before installing, expect the skill to generate and save a local CSS theme file. Choose the output filename deliberately and avoid overwriting an existing theme unless that is intended.
The skill content presents its operational instructions entirely in Chinese and uses mandatory language for agent behavior, but it does not state that the skill is intentionally restricted to Chinese users or offer an opt-in language choice. Under the language/locale policy, forcing a specific language without user opt-in can be a policy concern.
The skill explicitly instructs the agent to write generated CSS to a local file in the current directory, but it does not require user confirmation, safe default naming, or overwrite protection. In an automated agent context, silent file creation or replacement can cause unintended modification of workspace files or clobber an existing theme file, especially if downstream tools assume the file is trusted.
