Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to generate a local XMind test-case file from requirements, with no evidence of hidden access, exfiltration, persistence, or destructive behavior.
Install this only if you want a Chinese-oriented test-case mind-map generator. Run it in a workspace where overwriting testcase.xmind is acceptable, and be aware the published entry-point metadata appears inconsistent and may need packaging correction before it works reliably.
The skill hard-codes Chinese titles and field labels such as 测试用例, 前置条件, 步骤, and 预期结果, which enforces a specific language in generated output. The file does not offer a language choice or explain a justified region-specific constraint, creating a natural-language policy issue.
This is a manifest file, so vague-trigger checks apply. The description '根据需求生成XMind测试用例脑图' describes a general capability but provides no explicit trigger phrases, scope limits, or exclusion conditions, which can make invocation criteria ambiguous in systems that rely on manifest descriptions for routing.
The manifest description, input field descriptions, and the LLM prompt are all written to operate in Chinese, with no indication that the user can choose another language. This creates a language/locale policy concern because the skill appears to require a specific language without offering opt-in or alternatives.
The skill saves changes to a local file with xmind.save(workbook, file) but provides no confirmation prompt, print/log message, or inline comment/docstring disclosing that it overwrites or updates testcase.xmind. For a code file, file writes should have some visible user disclosure unless clearly documented elsewhere, which is not present in this file.
The requirement text is written entirely in Chinese and provides no indication that language choice is optional or limited to a justified region-specific context. This can violate a language/locale policy when a skill implicitly requires one language without offering user choice.
No suspicious patterns detected.
