Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward template generator that writes two project files and does not show hidden, destructive, credential-seeking, or exfiltration behavior.
Install this if you want Chinese-language Gin SSR page scaffolding from Figma screenshots. Review generated files before committing because the skill hardcodes SEO, language, placeholder URLs, and page content, and it may activate whenever a Figma page screenshot is supplied.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- 优先识别截图顶部标题或页面主标题
- 如果标题太泛（如“详情”“设置”“中心”），必须结合 main 首屏核心内容决定页面名
- 如果识别不到标题，在 HTML 顶部加注释：`<!-- 页面标题识别失败，需确认 -->`
### 1.2 页面名生成
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- 优先识别截图顶部标题或页面主标题
- 如果标题太泛(如“详情”“设置”“中心”),必须结合 main 首屏核心内容决定页面名
- 如果识别不到标题,在 HTML 顶部加注释:`<!-- 页面标题识别失败,需确认 -->`
### 1.2 页面名生成
The activation condition is broad enough that any Figma page screenshot may trigger the skill, even when the user did not explicitly request code generation for a Gin SSR template. That increases the chance of unintended execution, scope creep, and accidental processing of unrelated or sensitive screenshots.
The template fixes the page language to "zh-CN", and later structured data also uses "zh-CN" as the language. Because the skill does not offer user opt-in or explain that it is limited to a China-specific use case, this is a natural-language locale policy concern.
The WebSite and CollectionPage schema blocks specify "inLanguage": "zh-CN". This enforces a specific locale in generated content across all outputs, but the skill text does not indicate an optional or user-selectable language setting.
No suspicious patterns detected.