Security audit
Security checks for vulnerabilities and agentic risk
This skill is a benign UI framework guidance pack with no evidence of hidden access, persistence, or data misuse.
Installers should treat this as a framework reference skill. Review generated code for the locale your project actually needs, since several examples show Chinese i18n imports, but the package does not request sensitive access or persistent changes.
This manifest-like JSON file contains a prompt written entirely in Chinese, which can steer the skill toward a fixed language/locale behavior. The file does not indicate that language choice is optional or that Chinese is required for a region-specific purpose, so it may violate the policy against forcing a language without user opt-in.
The markdown contains a concrete internationalization example that hard-codes the zh-cn locale. Because the document does not mention that locale selection should be user-driven or optional, it can encourage implementations that force a specific language without user opt-in.
The note hard-codes use of the zh_CN locale in the internationalization example, which can be read as prescribing a specific language setting. Under the policy, locale-specific instructions should either offer alternatives or clearly justify why a fixed locale is required.
Line L206 recommends importing zh_CN locale config for internationalization, which is a natural-language locale directive. Because the documentation presents a specific locale choice without mentioning user preference, alternatives, or opt-in, it can conflict with language/locale policy requirements.
