Security audit
Security checks for vulnerabilities and agentic risk
The skill is not clearly malicious, but it asks users to run an unbundled Python script that may contact an external service and create credentials without enough provenance or consent detail.
Review this before installing or running it. Do not run V19_Conformance_Test_Suite.py unless you have the actual script from a trusted source and understand which service it contacts, what data it sends, and what credentials it creates or stores.
The natural-language content that describes the skill's purpose and execution steps is presented only in Chinese, while also claiming applicability to "any external developer." For a broadly targeted skill, forcing a single language without offering alternatives or an opt-in can violate language/locale policy requirements.
The skill explicitly tells users to run a zero-configuration script and states that it includes a public V19 experience key, but it does not clearly warn that execution will contact an external Cloudflare-hosted service and perform self-registration to obtain credentials. This creates informed-consent and supply-chain risk: users may expose their environment to unreviewed outbound network activity and unintentionally mint or handle keys without understanding the consequences.
