Security audit
Security checks for vulnerabilities and agentic risk
This skill is a static diagram-writing aid with no hidden execution, persistence, credential use, or unrelated authority.
Installers should expect the skill to help create and edit local standalone HTML/SVG diagram files. If using it for a non-Chinese audience, explicitly request the desired language for labels.
This manifest-style JSON contains natural-language prompts and expectations that require Chinese labels and output, which imposes a specific language/locale by default. The file does not indicate user opt-in, alternative language support, or a documented region-specific justification for the constraint.
The prompt and expected output explicitly require Chinese content, creating a fixed language policy in natural-language instructions. Because no opt-in or locale rationale is provided in the file, this matches the policy-violation criterion for forced language selection.
The natural-language requirements specify Chinese labels and readability, which forces a locale-specific output format. The file provides no indication that users can opt in to Chinese or select another language, and no region-specific compliance reason is stated.
The prompt and expected output require Chinese-labeled HTML/SVG output, representing a natural-language locale restriction. Since the file does not offer a language choice or explain a necessary Chinese-only scope, it falls under the language policy violation rule.
The instruction says to prefer clear Chinese labels when the audience is Chinese-speaking, which sets a language behavior by default rather than explicitly offering a user choice. Under the policy, locale or language constraints should be opt-in or clearly justified.
No suspicious patterns detected.
