Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent poster-generation helper with local canvas templates and QA utilities, and I found no hidden network, credential, persistence, or destructive behavior.
Before installing, note that this skill is best suited for static single-image canvas posters and PNG exports. Users working on charts, slide decks, multi-page documents, or language-sensitive templates should choose or adjust a more specific tool.
Referenced artifact was not completely inspected
4. **Build** — Start from `assets/template.html` (the multi-resolution engine). Replace the placeholder `draw*()` sections with your content. Keep W/H as *logic
The invocation text is unusually broad and includes many generic user intents such as posters, banners, infographics, higher-resolution export, and even cases where the user never mentions canvas. That can cause the agent to route unrelated or only partially related requests into this skill, increasing the chance of inappropriate tool use, unexpected file generation, or bypass of a more specialized and safer skill.
The document sets lang="zh-CN", which hard-codes a specific language/locale for the skill output. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy concern.
Line L15 uses the Chinese phrase "上次的配色不错" as the only concrete user utterance example. This can be interpreted as a locale-specific assumption in the skill's natural-language guidance without any opt-in or explanation that the skill is intended for Chinese-language inputs.
No suspicious patterns detected.