Security audit
Security checks for vulnerabilities and agentic risk
This skill prepares WeChat drafts and banners with disclosed, purpose-aligned file, memory, clipboard, and image-service use.
Confirm the configured image provider before using confidential material; banner concepts may be sent to that service. Expect saved drafts and preference notes, a topic-tracking update, and clipboard replacement. Referenced family documents and companion skills were not bundled or assessed. The scanner completed its review, and independent inspection found no malicious behavior in the supplied artifact.
L74 explicitly instructs the agent to give an English image-generation prompt to Gemini. This contradicts L53's requirement to use domestic models at the execution layer and never guide users toward overseas models, reinforced by L90; banner generation has no stated exception.
The workflow directs the agent to submit a content-derived prompt to an external image service without a sensitivity check or explicit authorization for sharing unpublished material. Inputs can include private fragments or drafts, so a prompt could disclose confidential details before the user approves publication. The legitimate banner-generation purpose and environment-based credential handling reduce suspicion of malicious intent, but do not prevent content disclosure.
The instruction explicitly requires an English prompt for Gemini. Although this concerns an intermediate artifact rather than the final post, it still mandates output in a specific natural language without offering a choice or explaining why that language is necessary.
