Security audit
Security checks for vulnerabilities and agentic risk
This is a small random-picker skill with no sensitive access, persistence, or network behavior, though its documentation is Chinese-only and includes unrelated promotional links.
Installation appears low risk from a security standpoint. Users should know the examples and feature list are not fully accurate: the script does not implement the documented --count flag, weighted selection, or secrets-based randomness, and the external AISoBrand links are promotional rather than required.
The natural-language content of the skill, including its name, description, features, and usage guidance, is presented only in Chinese. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
The skill documentation includes unrelated promotional branding and external website links that are not necessary for operating a random-picker tool. Even though this is not code execution, it introduces trust and supply-chain risk by steering users to external domains from within a utility skill, which can be abused for phishing, tracking, or reputation laundering.
