Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently generates HTML slide decks from user-provided content and references, with no bundled executable code or hidden persistence.
Before installing, users should be comfortable sharing any uploaded reference images or files for processing, and should expect the generated HTML presentation to be saved locally and returned as a file. Avoid uploading confidential material unless the surrounding platform and tools are approved for that data.
The manifest description and operating instructions are entirely in Chinese and implicitly steer the interaction and output toward a single language/locale. There is no opt-in language choice or explicit justification that this is a China-specific or Chinese-only skill.
The skill explicitly states it will call a tool to download user-uploaded images, which is a data-handling operation involving user-provided files. The markdown does not disclose any caution about accessing, downloading, or processing uploaded content, even though the skill description is the primary user-facing warning surface here.
The skill description includes creating a local file and transmitting it back to the user, which affects user data and system state. The markdown does not include any explicit notice that the skill will write a local HTML file and send that artifact onward.
No suspicious patterns detected.
