Security audit
Security checks for vulnerabilities and agentic risk
This is a descriptive crisis-communication planning skill with no executable code, network use, credentials, persistence, or external actions.
Installers should treat the skill as strategic communication support only and verify legal, regulatory, safety, privacy, and market-specific claims with qualified local professionals before using any generated crisis response publicly.
Line L14 states that the documentation must be "English-first," which is a natural-language locale constraint. The file does not indicate user choice, opt-in, or a clearly justified region-specific reason for enforcing that language preference.
The policy requires flagging language or locale constraints that force a specific language without user opt-in. Lines L144-L146 introduce a full Chinese usage scenario and expected output, but the document does not explain that multilingual responses are optional or user-selected.
The manifest sets the skill language to "en" with no indication that users can opt into another language or that English is required for a region-specific or compliance reason. This matches the policy concern for language or locale constraints imposed without user choice.
No suspicious patterns detected.
