Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Windows Start Menu shortcut scanner and app launcher, with no evidence of hidden or malicious behavior.
Before installing, understand that this Windows-only skill is intended to scan Start Menu shortcuts, cache the shortcut list locally, and open apps based on fuzzy name matching. Use care with ambiguous app names, and note that the published artifact appears incomplete because the manifest points to main.ps1 but only documentation and schema files are included.
The skill name, description, usage examples, and invocation phrase are all presented exclusively in Chinese, including the trigger-like example "检查并开始菜单管理". There is no indication that other languages are supported or that the Chinese locale requirement is optional, which can violate language/locale policy for general-purpose skills.
The documentation says the skill 'only reads Start Menu shortcuts' and 'does not modify system settings,' which communicates a read-only safety posture. Elsewhere in the same file, the skill's stated behavior includes 'quickly open applications' and examples like opening WeChat or Steam, which is an active side effect beyond mere reading.
This is a manifest file, so vague-trigger review applies. The description says the skill will 'automatically search and save' Start Menu shortcuts and 'quickly open applications according to user instructions,' but it does not define specific trigger phrases, scope limits, or exclusion conditions, making invocation boundaries unclear.
The natural-language fields in the manifest are entirely in Chinese, which imposes a specific language/locale presentation without indicating user choice or a documented region-specific requirement. Under the policy, language constraints should be optional or clearly justified.
