Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed video-comment analysis workflow that creates a local visual report, with minor user-awareness considerations around language defaults and auto-opening the report.
Install this if you want a Chinese-oriented seller/operator report for video comments. Be aware it defaults to saving a report on the Desktop and opening it automatically; ask the agent to use a different language, path, or no auto-open behavior if that matters.
The skill instructs the agent to automatically create files under a local Desktop path and open the generated report page without requiring an explicit user-facing confirmation. This creates an unauthorized side effect on the local system and may surprise users, especially when the task only asked for analysis rather than persistent file creation or browser navigation.
The document hard-codes lang="zh-CN", and the visible labels throughout the template are also fixed in Chinese. This creates a natural-language locale constraint without any indication of user opt-in or a documented region-specific justification.
The document is written as a fixed execution manual entirely in Chinese and presents default execution rules for all future tasks, but it does not state that language should follow the user's preference or allow opt-in selection. This can violate language or locale policy when the user expects another language.
The default page module order is specified entirely in Chinese, which imposes a specific language convention in the template guidance. The file does not state that the skill is China/Chinese-market specific or give the user an option to choose another language, making this a natural-language locale policy concern.
The manual explicitly says the skill should automatically open the final analysis report page after completion. Triggering navigation or opening a page without user confirmation can cause unexpected browser actions, disrupt the user's workflow, and normalize silent UI actions that may become riskier in more privileged contexts.
This markdown file mixes English guidance with multiple required content labels and sample statements written only in Chinese. Because the document does not state that the skill is region-specific or offer a language/locale choice, it appears to impose a specific language for outputs, which can violate language/locale policy expectations.
No suspicious patterns detected.
