Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward eNSP topology file generator that creates requested .topo files without hidden execution, persistence, credential access, or data exfiltration.
Install this if you want an agent to generate Huawei eNSP .topo files. Expect it to create files in the working directory, so review the filename and avoid overwriting existing work; use a different diagramming workflow for generic network diagrams outside eNSP.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<?xml version="1.0" encoding="UNICODE" ?>
<topo version="1.3.00.100">
<devices>
<!-- Device definitions -->
</devices>
<lines>
<!-- Connection lines -->
The README says the skill generates topology files using 'natural language,' but it does not define specific trigger phrases, scope limits, or exclusion conditions. This broad invocation description could overlap with ordinary requests about networks and makes it unclear when the skill should activate versus when it should not.
The activation text uses broad phrases such as 'create, generate, or design a network topology diagram' and 'always use,' which can cause the skill to trigger on common diagramming or networking requests outside the narrow eNSP/Huawei context. Over-broad activation can route unrelated user requests into a file-writing skill, increasing the chance of unintended local file creation or incorrect task handling.
The skill explicitly instructs the agent to write a .topo file to the current directory without prior user confirmation or a safety notice. In an agent environment with filesystem access, this creates an unnecessary side effect and could overwrite files, clutter the workspace, or surprise users who only wanted a design draft rather than local file modification.
This markdown file uses Chinese throughout, including the title, descriptions, and usage instructions, but does not indicate that the skill is Chinese-only or offer users an alternative language. Under the policy criteria, forcing a specific language without user opt-in can be a natural-language policy violation.
The text states charset | 1=UTF-8/ASCII, 134=GBK/Chinese, which introduces a language/locale-specific encoding recommendation in the skill reference. Because the document does not explain when Chinese encoding is appropriate or present it as an explicit user choice, it may create an unnecessary locale bias.
No suspicious patterns detected.