Security audit
Security checks for vulnerabilities and agentic risk
This is a simple data-format conversion skill with no evidence of hidden access, persistence, credential use, network activity, or destructive behavior.
Installers should expect a lightweight converter for text data formats. Review the broad triggers and Chinese-first documentation if precise routing or English-only behavior matters, and do not rely on the included sample implementation for complex CSV, YAML, or XML edge cases without hardening it.
The natural-language instructions and headings are primarily presented in Chinese, which can impose a language preference on users without explicit opt-in. The file does not state that the skill is region-specific or offer bilingual guidance beyond a few trigger examples.
The trigger phrase "格式转换" is very broad and could match many ordinary user requests that are not specifically intended to invoke this skill. Overbroad activation increases the chance of unintended routing or invocation, which can cause incorrect tool selection and confusing behavior even though it does not directly enable code execution or data exfiltration.
The phrase "格式互转" is ambiguous and lacks clear boundaries on what kinds of format changes are supported. This can lead to accidental invocation for unrelated transformations, increasing misrouting risk and reducing predictability of the agent's behavior.
This manifest includes Chinese trigger phrases at L06-L07 and a Chinese-only implementation description at L13, while also listing some English triggers. The file does not state that the skill is intentionally bilingual or let users choose a language/locale, which can violate language/locale policy expectations for natural-language behavior.
No suspicious patterns detected.
