Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local phone-number normalizer with no evidence of network access, persistence, credential handling, or hidden agent behavior.
Reasonable to install for local phone-number normalization. Review the default country behavior before relying on it in production, because the documentation and code disagree in places.
The file’s user-facing description and instructions are presented only in Chinese, which effectively forces a specific language for users of the skill. The policy allows locale constraints only when there is explicit opt-in or a clearly justified region-specific purpose, neither of which is stated here.
This Python file contains user-facing natural-language documentation in French ('LIMITATIONS CONNUES', 'Pas de validation en temps réel') while the rest of the interface and code are not explicitly scoped to French-only users. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
The skill description and usage guidance are presented almost entirely in French, which can impose a language preference on users without opt-in. The policy allows locale constraints only when they are explicitly justified or when the user is given a language choice, neither of which appears here.
No suspicious patterns detected.
