Security audit
Security checks for vulnerabilities and agentic risk
This is a markdown-only Chinese content-idea helper with no evidence of hidden code, credential use, persistence, or unsafe authority.
Install only if you want a Chinese-oriented content ideation workflow. Ask explicitly for another language if needed, and be aware the trigger wording is broad enough that content-planning requests may invoke it automatically.
The document title and all user-facing instructional content are written in Chinese, with no indication that other languages are supported or that Chinese is an optional locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.
The entire README presents the skill as operating in Chinese and promises responses directly in that language, but it does not state that users can choose another language. This can violate language/locale policy when a skill implicitly forces a specific language without offering opt-in or alternatives.
The README tells users '告诉我' followed by four general content parameters, but it does not define a specific trigger phrase, activation boundary, or exclusion conditions. In a markdown skill description, this broad natural-language invocation guidance could overlap with ordinary conversation about domain, audience, or platform and make the activation scope unclear.
Natural-language content throughout the file is presented exclusively in Chinese, including the description, triggers, workflow, and examples, with no indication that users may interact in another language. Under the language/locale policy, a skill should not force a specific language unless the user opts in or the locale limitation is clearly justified.
The trigger list is broad and includes common conversational phrases such as asking for ideas or direction, which can cause the skill to activate when a user did not explicitly intend to use it. This can lead to inappropriate routing, reduced reliability, and accidental disclosure of user context to the wrong skill, though it does not by itself create code execution or data exfiltration risk.
No suspicious patterns detected.
