Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only animation storyboard helper with no hidden execution, credential access, network behavior, or persistence.
Safe to install from a security perspective. Before using it, only upload reference images you are comfortable sharing with the agent workflow, and avoid sensitive personal photos, IDs, private locations, confidential material, or copyrighted images you do not have rights to use.
The example invocations and workflow are written as if the skill operates in Chinese by default, including user prompts and AI responses in Chinese. This creates a language/locale constraint without any indication that users may choose another language or opt in to Chinese output.
The manifest description and the entire skill instructions are written as a Chinese-only workflow, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language audience for a documented reason. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation.
The skill explicitly asks users to upload reference images for characters, scenes, and objects, but it provides no warning against sharing personal, sensitive, or copyrighted imagery. This can lead users to disclose faces, homes, documents, location clues, or other identifying content that may be retained, processed, or reused beyond their expectations.
This markdown file is entirely written in Chinese and provides no indication that language selection is optional or user-configurable. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
技能描述强调基于动画法则生成专业分镜脚本，但该输出在字幕中出现“坑 1：乱帮私活”，与当前“熬夜脸救星”主题及动画脚本创作目标无关，像是残留或串台内容。这表明实际产出未稳定遵循所宣称的脚本生成意图，存在描述与行为层面的不匹配。
The user-facing content fields throughout the JSON are entirely in Chinese, including theme, content, platform, style, and tone, with no indication that language selection is configurable or user-chosen. Under the policy rule for natural-language violations, this can be treated as forcing a specific language without opt-in unless the skill is explicitly documented as region-specific.
No suspicious patterns detected.
