Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed workflow for generating illustrated Instagram carousel images, with expected use of image-generation services, local render files, and Telegram delivery.
Install only if you are comfortable with the agent using your configured image-generation provider, creating files under entregables/, rendering local HTML with Chrome headless, and sending the resulting images through Telegram. Confirm costs and output destination before running large batches.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Si algún slide muestra una pantalla de app, generarla primero como HTML independiente:
<!-- mockup-[nombre].html — 1080×1350px, no necesita ser 4:5 exacto -->
<!DOCTYPE html>
<html><head>
<style>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Si algún slide muestra una pantalla de app, generarla primero como HTML independiente:
<!-- mockup-[nombre].html — 1080x1350px, no necesita ser 4:5 exacto -->
<!DOCTYPE html>
<html><head>
<style>
Referenced artifact was not completely inspected
Consultar `references/guia-ilustraciones.md` para:
The activation rule in the skill description is overly broad and can cause the agent to invoke this skill for loosely related requests based on vague variations. Overbroad auto-activation increases the chance of unintended tool use, file generation, or external API calls when the user's request did not clearly ask for this workflow.
The condition 'any carousel where the concept is abstract and needs conceptual visualization' is subjective and expansive, making accidental activation likely. In this skill, accidental activation is more dangerous because it can cascade into other skills, external image generation, local file writes, and headless browser rendering.
Line L004 states that each illustration type includes a description in English for the Higgsfield prompt, and multiple later headings reinforce this requirement. This is a natural-language locale constraint presented as a default without user opt-in or explanation of why English is required.
No suspicious patterns detected.