Security audit
Security checks for vulnerabilities and agentic risk
This skill generates a local creative-writing HTML app and does not show hidden, destructive, credential-seeking, or network behavior.
Installers should expect this skill to create or overwrite a local HTML app file when invoked. Use explicit prompts and specify an output path if you want to avoid accidental writes from broad trigger phrases.
The trigger set includes highly generic phrases such as '创意写作', '写作灵感', and '写作应用', which are common in ordinary conversation and can cause the skill to activate when the user did not intend to generate and write a full HTML file. Because this skill performs autonomous artifact generation, accidental activation can lead to confusing behavior and unintended file creation.
The invocation list includes short or context-light forms like '生成642' and references to '642件事', which are ambiguous and may match unrelated requests involving the number 642 rather than this specific skill. In a skill that automatically executes a workflow, ambiguous shorthand increases the chance of unintended activation and downstream side effects.
The skill directs the agent to write a file to a default workspace path automatically, and the document emphasizes that the bot should execute the workflow directly without requiring extra user input. Automatic file creation without an explicit confirmation or dry-run preview is risky because accidental activation or path misunderstandings can modify the workspace unexpectedly.
No suspicious patterns detected.
