ui-framework-spec

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 8:05 AM UTC
• Version: 0.1.0

Overview

This skill is a documentation-only UI framework guide and does not request sensitive access, persistence, or hidden execution.

Install this if you want an agent to follow specific UI framework conventions. Be aware that some examples use Chinese locale imports, so confirm locale choices when generating real application code.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This JSON eval includes a prompt written entirely in Chinese, which implicitly requires the skill to operate in a specific language. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: This JSON file is a manifest-like artifact, so SQP-3 applies. The prompt at L40 switches to Chinese, but the file provides no indication that language choice is user-selected or that the skill is explicitly region-specific, which can conflict with language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The markdown includes a specific internationalization example that imports the `zh-cn` locale, but it does not indicate that this is merely one option among many or that locale should be chosen based on user preference. This can be read as prescribing a specific language/locale, which may conflict with language-choice policy absent opt-in or justification.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This markdown file includes a specific locale import `zh_CN` and shows configuring the provider with that locale, but it does not mention that locale selection should depend on user preference or context. Under the policy, forcing a specific language or locale without opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Line L206 gives a specific internationalization example that imports `zh_CN` and applies it globally, which can be read as directing use of a fixed locale. Because the document does not mention offering users a language choice or that this is only an optional example, it may conflict with language/locale choice policy.

Static analysis

No suspicious patterns detected.