Security audit
Security checks for vulnerabilities and agentic risk
This is a simple code-to-flowchart skill with no hidden execution, persistence, credential handling, or destructive behavior found.
Before installing, expect a lightweight helper for turning code snippets into flowchart text. Review the generated Mermaid or PlantUML output before using it, especially for complex loops, and be aware that the skill documentation and triggers are mostly Chinese.
The skill content is written to operate in Chinese without documenting user choice, language negotiation, or justification, which can lead to mismatches between user intent and skill behavior. While not directly a code-execution risk, this can degrade transparency and cause users to receive outputs in an unexpected language, increasing confusion and misuse risk.
The trigger phrases are generic enough to match ordinary user requests such as asking to visualize code or generate a flowchart, which can cause the skill to activate unexpectedly. Over-broad activation increases the chance of incorrect routing, unintended handling of user data, or interference with safer or more appropriate skills.
This manifest lists trigger phrases such as '生成流程图', 'flowchart', and '代码结构图' without specifying the context in which the skill should activate or when it should not. Because there are no negative examples, scope limits, or invocation constraints, the triggers may match ordinary requests more broadly than intended.
Natural-language instructions and trigger patterns are primarily in Chinese, which can imply a fixed language expectation for users. The file does not state that language choice is optional or that equivalent triggers in other languages are supported.
No suspicious patterns detected.
