Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Chinese-language 3D training page generator with local templates and a local audit script, and I found no evidence of hidden data theft, persistence, or destructive behavior.
Use this if you want a Chinese-language offline WebGL training-page generator. Expect it to search public specs when you do not provide source material, create project files, and run the local audit script against generated HTML. Review output paths before allowing overwrites and verify any researched technical standards, but there is no artifact-backed evidence of exfiltration, hidden persistence, or destructive behavior.
声明描述的是“3D虚拟仿真实训系统制作技能”，核心承诺是根据用户需求制作单文件 HTML 的 3D 仿真培训页面。但提供的代码是 audit_sim3d.py，其输入是已有的 HTML 文件路径，行为包括读取文件、用正则和关键词检测 WebGL/软渲染、脚本闭合、外链依赖、中文界面、交互、教学闭环、评分机制等，并输出审核报告与通过/不通过结论。这属于质量审计/验收工具，而不是内容生成或页面制作工具。尽管审核标准围绕 3D 仿真实训页面，领域相关性很强，但主功能与声明的主用途发生了实质偏离，因此应判定为描述与代码行为不一致。
Referenced artifact was not completely inspected
| 场景组装 | 相机/地面/车间设备（举升机/传送带/值机岛） | `references/rendering-rules.md` §1 |
Referenced artifact was not completely inspected
| 场景组装 | 相机/地面/车间设备（举升机/传送带/值机岛） | `references/rendering-rules.md` §1 |
Referenced artifact was not completely inspected
| 场景组装 | 相机/地面/车间设备（举升机/传送带/值机岛） | `references/rendering-rules.md` §1 |
Referenced artifact was not completely inspected
| 场景组装 | 相机/地面/车间设备（举升机/传送带/值机岛） | `references/rendering-rules.md` §1 |
Referenced artifact was not completely inspected
| 场景组装 | 相机/地面/车间设备（举升机/传送带/值机岛） | `references/rendering-rules.md` §1 |
Suspicious Unicode normalization or mixed-script content
The skill instructs the agent to read reference files and write generated HTML output, but it does not declare an explicit tool/permission scope. In agents that rely on manifest-level scoping, this can lead to overbroad file access or ambiguous enforcement, increasing the chance of unintended reads/writes beyond the project boundary.
Line L145 states '中文学术语言' as a hard architectural rule, requiring Chinese terminology and style for outputs. This is a natural-language locale constraint and the file does not provide opt-in, alternatives, or a region-specific justification that would exempt it.
The title and surrounding instructions present the skill as Chinese-only, and the embedded HTML explicitly sets lang="zh-CN". For SQP-3, this is a natural-language locale policy concern because the file does not offer an opt-in language choice or explain why the skill must be limited to Chinese users.
Suspicious Unicode normalization or mixed-script content
This markdown file presents all user-facing guidance and examples exclusively in Chinese, including the title, instructions, SOP examples, and warnings. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can exclude users who do not understand that locale.
Suspicious Unicode normalization or mixed-script content
Lines L078-L079 instruct authors to use industry terminology in Chinese and to search first if unsure, which imposes a specific language/locale expectation in natural-language guidance. The file does not offer an opt-in choice of language or explain that the skill is intentionally limited to a Chinese-language context.
The file consistently prescribes Chinese labels, tooltips, and interface text such as 点击聚焦 and Chinese part names, indicating the skill is designed to output a specific language. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
Suspicious Unicode normalization or mixed-script content
Suspicious Unicode normalization or mixed-script content
Line L061 hard-fails content that does not contain at least 150 Chinese characters via the check 中文界面(≥150汉字). This is a natural-language policy concern because it imposes a specific language requirement programmatically, with no opt-in, alternative locale support, or documented regional-compliance justification in the file.
This markdown skill content forces a specific language/locale for all instructions and code explanations, which can violate language-choice policy when no user opt-in or justification is provided. There is no indication that the skill is intended only for a Chinese-language audience or region-specific use.
No suspicious patterns detected.