Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to safely create a local HTML slide deck from a Markdown outline, with only minor scoping and locale caveats.
Install this if you want a zero-dependency local HTML slide generator. Be aware it writes or overwrites deck.html in the directory where it runs, expects UTF-8 Markdown input, and is primarily tailored for Chinese-language decks rather than PowerPoint/PDF export.
The skill describes creating and overwriting a local output file (deck.html) and instructs execution of a Python script, but it declares no explicit tool scope such as file-write permissions. In an agent environment, missing scope declarations can lead to broader-than-expected file access or unsafe execution assumptions, increasing the chance of unauthorized local file modification.
The description says to use the skill when the user mentions phrases like「做个PPT」or「生成幻灯片」, which are broad everyday requests that could match many different presentation-related skills. The file does not provide exclusion conditions or tighter scope boundaries to distinguish when this HTML-only deck builder should activate instead of other slide-generation skills.
The trigger list includes phrases like「做个PPT」and「生成幻灯片」without specifying output format, environment, or limitations. Because the skill is specifically for generating a local HTML slide deck, the current trigger list is too unspecific and may cause unintended invocation for ordinary PowerPoint or slide requests.
Lines L82-L88 explicitly state '中文字体栈（必写全）' and provide a mandatory Chinese font stack for the skill output. This imposes a language/locale-specific requirement without user opt-in or a clearly documented region-specific justification, which matches the natural-language locale policy violation criteria.
The module docstring and all CLI/user-facing messages are written in Chinese, and the generated HTML explicitly sets lang="zh-CN". This imposes a specific language/locale on users without any opt-in, choice, or stated region-specific justification, which matches the natural-language locale policy violation criteria.
