Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local design-system package with CSS, HTML layouts, registries, and a showcase, with no evidence of hidden commands, credential access, exfiltration, or persistence.
Install this if you want the yuanfang design templates. Review the Chinese language/font defaults if your output should be locale-neutral, and run the showcase generator only in the intended yuanfang workspace because it writes local showcase files and imports a sibling yuanfang-html-image module.
The declared description says this skill provides a reusable design system with themes, CSS tokens, and layout blocks. However, the provided code chunk contains only a basic smoke test for the test framework and does not implement or expose any design-system functionality. This is a materially different primary purpose, so it should be flagged as a mismatch.
Referenced artifact was not completely inspected
└── showcase/cover-showcase.html
Referenced artifact was not completely inspected
└── showcase/cover-showcase.html
The stylesheet explicitly prioritizes "PingFang SC", "Microsoft YaHei", and "Noto Serif SC" in its font stacks, which reflects a specific language/locale preference in natural-language-identifiable font choices. There is no nearby comment indicating this is optional, user-selected, or justified as a region-specific requirement.
The HTML root sets lang="zh-CN", which forces a specific language/locale in the document. Under the policy for natural-language violations, locale constraints should either be user-selectable or clearly justified as region-specific; this file provides neither.
The CSS hard-codes font stacks including 'Noto Sans SC' and 'Noto Serif SC', which are Simplified Chinese locale-specific fonts. This may impose a language/locale preference in presentation without any visible opt-in or justification in the file.
The CSS hard-codes Noto Sans SC and Noto Serif SC, where SC denotes Simplified Chinese, as fallback fonts in the theme. This introduces a locale-specific preference in a file that does not document user choice or a region-specific justification, which can conflict with language/locale policy expectations.
The font stack explicitly includes 'Noto Sans SC', which is a Simplified Chinese locale-specific font, in both body and display typography. Because this file provides no accompanying natural-language justification or user choice, it can be interpreted as imposing a locale preference contrary to the language/locale policy criteria.
The CSS explicitly prioritizes 'Noto Sans SC' and 'Noto Serif SC' in the font stacks, which encodes a specific locale/script preference in the skill asset. The provided file does not indicate any user choice, opt-in, or region-specific justification for this language/locale selection.
The description says the theme uses a "vertical CJK title," which is a locale-specific presentation choice embedded in natural language. Because the file does not indicate that this language/layout constraint is optional or limited to a clearly region-specific use case, it can conflict with the policy against forcing a specific language or locale without user opt-in.
No suspicious patterns detected.