Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently generates a weather-and-outfit SVG poster and does not show hidden execution, credential access, persistence, or unrelated data handling.
Install this if you want a Chinese-style weather/outfit SVG poster generator. Be aware it may contact a weather source such as wttr.in and will create a `{city}-weather-poster.svg` file in the workspace; ask for a different filename or locale if needed.
The trigger definition includes the catch-all phrase "or similar," which can cause the skill to activate for loosely related requests beyond weather-poster generation. Overly broad activation increases the chance of unintended execution, especially because the skill performs downstream actions like fetching external weather data and writing an SVG file to the workspace.
This SVG template hard-codes Chinese-language user-facing text such as "今日天气穿搭" and date labeling, which imposes a specific language/locale in a file type covered by the natural-language policy rule. The file does not offer any language selection or document that the skill is intentionally region-specific, so it appears to violate the requirement not to force a language without user opt-in.
Several other visible labels, including "微风" and "今日穿搭推荐", are fixed in Chinese and reinforce that the skill output is locked to one language. Because no opt-in, fallback, or locale configuration is present in the template, this is a natural-language locale policy concern rather than a cosmetic choice.
The visible text strings and date/weekday placeholders are specified in Chinese (for example, the title text and the requirement that weekday be in Chinese). This enforces a specific language/locale in the template without any opt-in or indication that the skill is intentionally limited to Chinese-speaking users or a China-specific context.
The outfit section header is hard-coded as Chinese text, which means generated output will always use that language. Because the file does not present this as an optional or region-specific template, it conflicts with the policy against forcing a language without user opt-in.
The variable table explicitly requires the date format to use Chinese year/month/day notation and the weekday to be in Chinese. This is a direct natural-language locale constraint that is not presented as optional or justified by a documented region-specific use case.
The skill states that it will save an SVG file into the workspace but does not clearly warn the user that it performs a file write. Undisclosed file creation can surprise users, clutter the workspace, or interact poorly with automated workflows that assume read-only behavior.
No suspicious patterns detected.
