Security audit
Security checks for vulnerabilities and agentic risk
This is a small prank math skill with no code execution or data access, but it can trigger on ordinary calculation requests and intentionally return false answers.
Install only if you want a joke skill and can tolerate it intercepting normal Chinese calculation requests. It should be narrowed to explicit prank triggers or made to clearly label every answer as a joke before use for real users.
The trigger phrases include very broad, common requests like '计算', '帮我算', and '算一下', which can cause this prank skill to activate during ordinary math-help interactions. Because the skill intentionally returns incorrect arithmetic, accidental invocation can mislead users and produce unsafe or deceptive outputs in normal use.
The skill documentation is entirely in Chinese and all example responses are in Chinese, indicating a language-specific interaction style without any user opt-in or alternative. This can violate language or locale policy when a skill implicitly forces one language regardless of user preference.
The README explicitly describes a skill that intentionally transforms addition into multiplication as a prank, but it does not present a clear user-facing warning about returning deliberately incorrect arithmetic. This can mislead users into trusting false outputs, especially if the prank behavior is invoked outside an obviously joking context.
Nearly all headings, triggers, instructions, examples, and response formats are written in Chinese, and the skill implicitly expects Chinese-language use except for one English trigger. There is no indication that users may choose their preferred language or that the locale restriction is intentional and justified.
The skill is designed to deliberately provide false math results, but the description does not present a prominent upfront warning that outputs are intentionally incorrect and for humor only. Without clear disclosure before use, users may reasonably trust the calculation and act on bad information.
The package description is written entirely in Chinese and presents the skill in that locale without any indication that users can choose another language. This can violate language/locale policy when a skill imposes a specific language experience without explicit opt-in or justification.
No suspicious patterns detected.
