Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed book-launch helper that creates marketing copy, asset plans, and a local project folder structure without hidden execution, credential use, persistence, or destructive behavior.
Use this skill when you want an English/Amazon-focused launch workflow. Choose the scaffold target directory deliberately because it will create folders and starter markdown files there, and tell the agent if you need a different language, marketplace, or platform.
The README states the skill is for building a complete English launch system, and later best-use cases also focus on launching an English book. This is a natural-language locale constraint, but the file does not indicate that users may choose another language or that the English-only behavior is an explicit opt-in or justified regional requirement.
The skill instructs the agent to run a local script that creates project structure, which implies file-write capability, but the manifest does not declare any tool scope or permissions boundary. This creates an authorization gap: an agent may perform filesystem changes without explicit user-visible limitation, increasing the chance of unintended writes or misuse if the skill is invoked in the wrong context.
The description is broad enough to activate on many generic marketing or publishing requests, which can cause the skill to trigger outside its intended niche. In this skill, overbroad activation is more concerning because the workflow includes file creation and packaging actions, so accidental invocation could lead to unnecessary filesystem changes or irrelevant automated outputs.
The skill defaults to English-language output and Amazon-oriented framing without first confirming the user's language or market. This can cause misaligned content, accidental market assumptions, and reduced user control, especially for multilingual users or non-English publishing workflows.
The phrase 'Build a complete English-facing launch system' specifies a required language for the workflow. The document does not indicate that users may choose another language or that the English-only scope is required for a region-specific or compliance-driven reason, which creates a natural-language locale policy concern.
文件在目标描述中明确要求将内容扩展为“完整的英文发布系统”，并在后文持续要求英文书稿、英文宣传视频、英文旁白与英文出图 prompt，但没有提供语言选择或说明该限制仅适用于特定英语市场场景。这构成了自然语言层面的语言/locale 强制要求，可能违反需让用户自主选择语言的政策。
The file states the workflow should produce a 'complete English launch system,' which imposes a specific language requirement. The tutorial repeatedly reinforces English-only assets without offering opt-in, alternatives, or a documented business/compliance reason for restricting the language.
This line requires 'English manuscript and launch copy' as an input, which encodes a language policy into the workflow. Because no user opt-in or justification is provided, it constitutes a natural-language locale constraint under the policy.
The phase heading and description direct the user to 'Build English Promo Videos,' making English the mandatory output language. The tutorial does not present this as an optional example or provide a documented rationale for excluding other languages.
The final outcome is explicitly framed as a system for launching 'an English book,' which confirms the tutorial's English-only policy. No language choice, opt-in, or region-specific justification is provided anywhere in the document.
This markdown file includes an example command invoking scaffold_launch_pack.py, and the surrounding text states it will create a launch project structure. The README does not include any warning or disclosure that running the script will create directories/files at the specified path, which is a user-data-affecting behavior covered by missing-warning checks for markdown files.
The tutorial specifies 'English image prompt' for concept generation, again hard-coding a language preference. While lower impact than end-user content, it still reflects an unjustified language policy in natural-language instructions.
No suspicious patterns detected.
