Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-first CET-4/CET-6 exam-prep skill with no code execution, persistence, credential use, or hidden high-impact behavior found.
Install this if you want CET-4/CET-6 coaching primarily in Chinese. It may ask for exam level, target section, current/target score, exam date, and study availability to personalize training; avoid sharing anything more personal than needed. Ask explicitly for English if you prefer it.
The README is entirely written in Chinese and describes the skill's interaction flow in Chinese, including the default startup prompt shown to users. Although an English README is linked, this file does not state that users may choose their preferred interaction language, so the documented behavior appears to assume a fixed language by default.
The skill hard-codes Chinese as the default user-facing language unless the user explicitly asks for English. This can override a user's expected language preference and reduce transparency or accessibility, especially in multilingual environments, but it does not directly enable code execution, privilege abuse, or data exfiltration.
The first-interaction rule mandates a Chinese opening question before proceeding, which enforces a language choice without prior user opt-in. In practice this can create a coercive UX pattern and may prevent clear consent or understanding for users who do not read Chinese, though the security impact remains limited in this exam-prep context.
The quality checklist reinforces Chinese-by-default output, institutionalizing the same language-lock behavior across all responses. This makes the behavior systematic rather than incidental, but within a CET exam-prep skill the context makes it less dangerous because the target audience is expected to be Chinese learners and no sensitive capability is exposed.
No suspicious patterns detected.
