Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent explainer workflow with optional video, diagram, HTML, and demo-tool helpers, but users should be careful with sensitive content sent to TTS or demo artifacts.
Install is reasonable for users who want Chinese-forward explainer artifacts. Before using the video or demo modules, avoid secrets, personal data, regulated data, or proprietary text unless you are comfortable with the selected TTS provider and demo storage location.
The declared purpose emphasizes generating explanatory artifacts, but the detected behavior includes STE100 compliance checking, local file reads, CLI-style validation, and CI gating functions that are not described. Hidden validator or gatekeeper behavior broadens the skill’s effective authority and may cause agents to feed local content into tooling paths that were never risk-reviewed for this use case.
The declared purpose emphasizes generating explanatory artifacts, but the detected behavior includes STE100 compliance checking, local file reads, CLI-style validation, and CI gating functions that are not described. Hidden validator or gatekeeper behavior broadens the skill’s effective authority and may cause agents to feed local content into tooling paths that were never risk-reviewed for this use case.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!DOCTYPE html>
<!-- llm-output-explainer · 模块 C 单文件讲解工件模板
设计系统已锁定（防 AI slop）：象牙底/石板灰文字/陶土主色，衬线标题+无衬线正文。
约束：单文件、零外部依赖。禁止引入 CDN 字体/库。 -->
<html lang="zh-CN">
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!DOCTYPE html>
<!-- llm-output-explainer · 模块 C 单文件讲解工件模板
设计系统已锁定(防 AI slop):象牙底/石板灰文字/陶土主色,衬线标题+无衬线正文。
约束:单文件、零外部依赖。禁止引入 CDN 字体/库。 -->
<html lang="zh-CN">
The skill invokes local file-read and shell-capable behavior but does not declare any tool scope or permission boundary. In an agent environment, undeclared capabilities reduce transparency and policy enforcement, making it easier for a benign explainer skill to perform unintended host inspection or command execution paths.
The manifest description is entirely in Chinese and presents the skill's activation and usage guidance in that language, but it does not indicate that Chinese is optional or limited to a region-specific audience. This can violate language/locale policy because it effectively forces a specific language without user opt-in.
The HTML document explicitly sets lang="zh-CN", and the surrounding comments/UI text are written only in Chinese. This indicates a fixed language/locale choice with no visible opt-in or alternative, which matches the policy category for language or locale constraints.
The helper function and its documentation explicitly enforce Chinese text rendering by requiring a Chinese-capable font and labeling it as mandatory. This is a natural-language locale policy issue because the template constrains output language/font conventions without presenting an alternative or user choice.
The audience matrix explicitly dictates language choices such as '零术语，全部翻译成人话' for executives and '严格术语表（STE100）' for future self / AI agent. This is a natural-language policy concern because it forces locale/style behavior based on audience category rather than offering the user a choice or opt-in.
Lines L37-L44 prescribe a specific language/locale approach for Chinese writing, including mandatory style rules, but do not indicate that this is optional or limited to explicitly Chinese-language content chosen by the user. This can be a natural-language policy issue because it imposes a locale-specific constraint without opt-in.
The entire skill guidance is written as Chinese-only prescriptive content, including required labels and workflow text, with no indication that users may choose another language or locale. This can violate language/locale policy because it imposes a specific language by default rather than offering opt-in or stating a region-specific justification.
The skill instructs sending the narration script to an external TTS tool/service (edge-tts) without any privacy notice, consent step, or data-sensitivity check. If users provide proprietary, personal, or regulated content, that text may be transmitted off-box to a third-party service, creating confidentiality and compliance risk.
The workflow hard-codes a Chinese voice (zh-CN-XiaoxiaoNeural) and frames Chinese voice selection as the default without asking the user for language or locale preference. This can cause misrepresentation, accessibility issues, and unintended disclosure of assumptions about audience or region, especially in multilingual or customer-facing contexts.
The guidance explicitly instructs authors to omit tests, error handling, and other safeguards for generated demo tools. Even if intended as disposable prototypes, such tools are often reused, shared, or accidentally promoted into broader use, which can cause unsafe behavior, misleading outputs, crashes, or insecure handling of inputs without any guardrails.
The document encourages loading 'real data' into disposable demo tools without any privacy, security, or data-minimization constraints. In this skill context, that increases the chance that sensitive business, customer, or regulated data will be copied into ad hoc artifacts stored in insecure locations or exposed through generated demo interfaces.
The module docstring and all user-facing usage/help text are written only in Chinese, indicating a fixed language/locale for interaction. The file does not offer an opt-in choice of language or explain that the tool is intentionally limited to a Chinese-only regional context.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if not path:
return False, "", f"未安装。{hint}"
try:
out = subprocess.run([cmd] + version_args, capture_output=True, text=True, timeout=15)
ver = (out.stdout or out.stderr).strip().split("\n")[0][:80]
return True, ver, ""
except Exception as e:
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
def check_import(module, pip_name, hint=""):
try:
mod = __import__(module)
return True, getattr(mod, "__version__", "installed"), ""
except ImportError:
return False, "", f"未安装。pip install {pip_name}。{hint}"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def check_cjk_font():
"""检查系统是否有可用中文字体（Manim Text 渲染中文必需）"""
try:
out = subprocess.run(
["fc-list", ":lang=zh", "family"], capture_output=True, text=True, timeout=15
)
families = sorted(set(l.strip() for l in out.stdout.splitlines() if l.strip()))
The script documents a runtime pattern that relies on unpinned npx package resolution for @mermaid-js/mermaid-cli, which can pull the latest package and transitive dependencies at execution time. That creates supply-chain risk and undermines reproducibility; if a malicious or compromised upstream version is served, later skill steps could execute untrusted code.
The module table describes 'Controlled writing (STE100-style)' as a standard mechanism, which can imply a fixed language/style constraint. Because the README does not explicitly state that users may choose another language or opt out, this may conflict with language/locale choice expectations.
This markdown file contains instructional content only in Chinese, which can impose a language constraint on users without opt-in. The policy requires flagging language or locale restrictions unless the skill explicitly offers a choice or clearly justifies the constraint.
The manifest describes a skill for explaining and presenting content, with possible generation of artifacts like videos and HTML pages, but it does not explicitly justify probing external network connectivity to a vendor endpoint. This file actively opens a socket to speech.platform.bing.com to test service reachability, which is a capability beyond text explanation itself.