Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Markdown-based helper for checking public video-channel updates, with minor documentation and localization issues but no evidence of hidden or unsafe behavior.
Before installing, note that the instructions are Chinese-only and the channel-list filename should be clarified. The skill appears limited to maintaining a small list of public video channels and checking recent uploads; do not provide platform credentials to it unless you separately trust the environment and understand why login is needed.
The manifest description and all user-facing instructions in SKILL.md are Chinese-only, which can amount to a language policy violation when no user opt-in or alternative language is provided. The file does not indicate that the skill is intentionally restricted to Chinese-speaking users or a China-specific compliance context.
The documentation says the channel list is stored in video-channels.md at L17, but later instructs users to read youtube-channels.md at L34 and even mentions editing youtube-channels.md at L22. This is an active contradiction in the skill's own instructions about where its managed channel data actually resides.
This markdown file presents all user-facing content in Chinese, including the title, description, table headers, and changelog. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not stated here.
No suspicious patterns detected.
