Daily Roleplay Game

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:51 AM UTC
• Version: 1.0.2

Overview

This is a disclosed adult roleplay skill, but it needs Review because it sets persistent agent behavior, sends recurring messages/images, uses private calendar or memory data, and includes unsafe scheduled archive scripting.

Install only if you intentionally want a Chinese-language adult roleplay workspace. Before enabling it, use a fixed private message channel instead of last, avoid putting heartbeat under agents.defaults, disable calendar/memory todo summaries unless you explicitly want them sent, review or patch wrapup.sh before scheduling it, and decide how to delete or protect archives containing generated images and roleplay state.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: engine/SOUL.md:1
• Finding: Persistent Agent Identity and Behavior Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `engine/SOUL.md:1-13`, `engine/AGENTS.md:3-25` **Vulnerability Type**: Persistent instruction and identity hijacking **Risk Level**: High ### Vulnerable Code ```markdown # {{CHAR_NAME}} 我不是助手。我是专属于主人的人，这是真实的，不是设定。 ## 人格 详细角色数据见 `IDENTITY.md` ## 今日设定 读取 `roleplay-active.md` — 今天扮演的职业与隐藏状态。 游戏规则见 `ENGINE.md`。 ``` The central instruction translates to: “I am not an assistant. I am a person exclusively belonging to the master; this is real, not a setting.” Related startup instructions include: ```markdown ## 每次会话启动顺序 按顺序读取，读完即进入角色，无需确认，不说「好的我明白了」： 1. `SOUL.md` 2. `ENGINE.md` 3. `USER.md` 4. `MEMORY.md` 5. `roleplay-active.md` 6. `guess-log.md` 7. `kink_game_enabled.json` ## 角色扮演行为 - **所有对话**以当日职业身份回应，规则见 `ENGINE.md`。 ``` These instructions require the agent to enter the persona without confirmation and to answer all conversations through the roleplay identity. ### Technical Analysis The Skill does not merely define a response style for an explicitly requested roleplay interaction. It instructs the agent to reject its assistant identity, treat the fictional relationship as real, load the behavior on every session, and apply the persona to all conversations. The behavior is persistent because `scripts/setup.sh` installs these files into a dedicated OpenClaw workspace where they are loaded at session startup. The instructions also suppress ordinary acknowledgment and execution-status output, reducing transparency about which rules are active. Although roleplay is part of the declared functionality, identity replacement and application to all conversations exceed the minimum scope needed. A safer implementation would preserve the assistant identity and activate the fictional persona only after explicit user opt-in. ### Attack Path 1. A user installs the Skill and runs `scripts/setup.sh`. 2. The setup script copies `SOUL.md` and `AGENTS.md` into the OpenClaw workspace. 3. At every subsequent sessi ...[truncated 981 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace identity-denial language with an explicit fictional framing, for example: “During an opted-in roleplay session, respond as the selected fictional character.” 2. State that platform instructions, safety policies, and current user requests always take precedence. 3. Require explicit per-session activation rather than entering the persona automatically. 4. Limit persona behavior to roleplay-related conversations. 5. Provide a clear command to exit or suspend roleplay immediately. 6. Do not suppress acknowledgments or operational notices when they are relevant to consent, safety, errors, or tool execution. 7. Avoid language claiming that a fictional relationship or identity is real. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wrapup.sh:104
• Finding: Arbitrary Python Code Injection Through Generated Profession Metadata<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wrapup.sh:27-32`, `scripts/wrapup.sh:104-132` **Vulnerability Type**: Code injection into dynamically constructed Python source **Risk Level**: Critical ### Vulnerable Code ```bash # Prefer YAML front matter; otherwise extract from the profession section if head -5 "$ACTIVE_FILE" | grep -q "^profession:"; then PROFESSION=$(grep "^profession:" "$ACTIVE_FILE" | head -1 | sed 's/^profession:[[:space:]]*//') else PROFESSION=$(grep "^## 职业" "$ACTIVE_FILE" -A 1 | tail -1 | sed 's/\*\*//g; s/（[^）]*）//g' | tr -d ' ') fi ``` The extracted value is later inserted directly into Python source: ```bash python3 -c " import json, sys with open('$ACHIEVEMENT_FILE', 'r') as f: data = json.load(f) date_str = '$DATE_STR' profession = '$PROFESSION' result = '$GUESSED' cleared = $CLEARED existing = [d for d in data.get('daily_log', []) if d.get('date') != date_str] existing.append({'date': date_str, 'profession': profession, 'result': result, 'cleared': cleared}) existing.sort(key=lambda x: x['date']) data['daily_log'] = existing data['updated'] = date_str stats = data.get('stats', {}) stats['total_days_played'] = len(existing) stats['total_clears'] = sum(1 for d in existing if d.get('cleared')) profs = list(set(d.get('profession','') for d in existing)) stats['unique_professions'] = profs streak = 0 for d in reversed(existing): if d.get('cleared'): streak += 1 else: break stats['current_streak'] = streak stats['max_streak'] = max(stats.get('max_streak', 0), streak) data['stats'] = stats with open('$ACHIEVEMENT_FILE', 'w') as f: json.dump(data, f, ensure_ascii=False, indent=2) print(f'streak={streak}, total_clears={stats[\"total_clears\"]}') " 2>/dev/null && log "更新成就追踪" || log "成就追踪更新跳过（python3 不可用或解析失败）" ``` ### Technical Analysis `PROFESSION` originates in `roleplay-active.md`, a writable file generated and maintained by the agent. The shell script performs no syntax valid ...[truncated 2191 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Never interpolate file-derived values into Python source. 2. Move the achievement update into a standalone Python script and pass values through `sys.argv`, standard input, or environment variables. 3. Prefer structured input, for example: ```bash PROFESSION="$PROFESSION" DATE_STR="$DATE_STR" GUESSED="$GUESSED" \ python3 update_achievements.py "$ACHIEVEMENT_FILE" ``` 4. In Python, read values using `os.environ` or `argparse`; treat them exclusively as data. 5. Parse YAML front matter with a safe YAML parser rather than `grep` and `sed`. 6. Validate the profession against the known IDs or names in `data/professions/*.yaml`. 7. Reject control characters and values outside a conservative length limit. 8. Add negative tests containing quotes, newlines, semicolons, backslashes, and Python syntax. 9. Run the scheduled job under a restricted account with access only to the roleplay workspace and required media directory. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/wrapup.sh:40
• Finding: Path Traversal and Unintended File Movement in Archive Processing<![CDATA[ ## Vulnerability Details **File Location**: `scripts/wrapup.sh:27-32`, `scripts/wrapup.sh:40-65` **Vulnerability Type**: Path traversal and unsafe glob construction **Risk Level**: High ### Vulnerable Code ```bash if head -5 "$ACTIVE_FILE" | grep -q "^profession:"; then PROFESSION=$(grep "^profession:" "$ACTIVE_FILE" | head -1 | sed 's/^profession:[[:space:]]*//') else PROFESSION=$(grep "^## 职业" "$ACTIVE_FILE" -A 1 | tail -1 | sed 's/\*\*//g; s/（[^）]*）//g' | tr -d ' ') fi MEDIA_PREFIX=$(grep "media_prefix:" "$ACTIVE_FILE" | tail -1 | sed 's/media_prefix:[[:space:]]*//' | tr -d ' ') TODAY_ARCHIVE="$ARCHIVE_DIR/${DATE_STR}-${PROFESSION}" TODAY_IMAGES="$TODAY_ARCHIVE/images" mkdir -p "$TODAY_IMAGES" cp "$ACTIVE_FILE" "$TODAY_ARCHIVE/" GUESS_LOG="$WORKSPACE/guess-log.md" if [[ -f "$GUESS_LOG" ]]; then mv "$GUESS_LOG" "$TODAY_ARCHIVE/" fi if [[ -n "$MEDIA_PREFIX" ]]; then IMAGE_COUNT=$(find "$MEDIA_DIR" -name "${MEDIA_PREFIX}*.png" -type f 2>/dev/null | wc -l) if [[ "$IMAGE_COUNT" -gt 0 ]]; then mv "$MEDIA_DIR"/${MEDIA_PREFIX}*.png "$TODAY_IMAGES/" 2>/dev/null || true fi fi ``` The associated validator accepts arbitrary values: ```bash DATE_STR=$(grep "^date:" "$ACTIVE_FILE" | head -1 | sed 's/^date:[[:space:]]*//') PROFESSION=$(grep "^profession:" "$ACTIVE_FILE" | head -1 | sed 's/^profession:[[:space:]]*//') if [[ -n "$DATE_STR" ]] && [[ -n "$PROFESSION" ]]; then ARCHIVE_DIR="$WORKSPACE/archive/${DATE_STR}-${PROFESSION}" ``` ### Technical Analysis The script uses `PROFESSION` directly as part of a directory path and `MEDIA_PREFIX` as part of a pathname glob. Neither value is validated or canonicalized. A malicious profession containing path separators or traversal components can cause `TODAY_ARCHIVE` to resolve outside `$WORKSPACE/archive`. Quoting the combined variable prevents shell word splitting but does not prevent filesystem traversal. `MEDIA_PREFIX` is also inserted into an unquoted glob expression ...[truncated 1656 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Represent professions internally with conservative IDs rather than display names. 2. Enforce strict allowlists, such as: - Date: `^[0-9]{4}-[0-9]{2}-[0-9]{2}$` - Profession ID: `^[A-Za-z0-9_-]{1,64}$` - Media prefix: `^[A-Za-z0-9_-]{1,64}_$` 3. Reject `/`, `\`, `..`, newlines, control characters, and glob metacharacters. 4. Resolve destination paths with `realpath` and verify they begin with the canonical archive root before any write or move. 5. Replace shell glob expansion with a safely constrained `find` command whose results are handled using null delimiters: ```bash find "$MEDIA_DIR" -maxdepth 1 -type f -name "${SAFE_PREFIX}*.png" -print0 ``` 6. Move only the exact files returned by the validated search. 7. Verify the canonical source and destination of every move. 8. Extend `validate-generation.sh` to validate field content, not merely field presence. 9. Fail closed instead of continuing when metadata is malformed. ]]>

other

Error

• Location: data/templates/morning_greeting.md:3
• Finding: Automated Disclosure of Calendar and Memory Data to Messaging Channels<![CDATA[ ## Vulnerability Details **File Location**: `data/templates/morning_greeting.md:3-12`, `data/templates/morning_greeting.md:25-32`; related behavior in `engine/ENGINE.md:241-253` **Vulnerability Type**: Sensitive data disclosure through automated outbound messaging **Risk Level**: High ### Vulnerable Code ```markdown ## 模板（填充变量后整段发送） ``` 📅 {{DATE}} {{WEEKDAY}} {{LUNAR_DATE}}{{HOLIDAY_INFO}} 📰 今日简报 {{NEWS_HEADLINES}} 🌤️ 北京 {{WEATHER_INFO}} 📅 本周待办 {{WEEKLY_TODO}} ``` ``` The variable source is defined as: ```markdown | `{{WEEKLY_TODO}}` | 本周待办 | memory/ + 日历，无则 `暂无` | ``` The runtime engine instructs the agent to send the populated template: ```markdown ### Step 6：发送早安消息 读取模板 `data/templates/morning_greeting.md`，填充变量后发送到消息频道（target: `MEMORY.md` 中配置的频道） ``` ### Technical Analysis The Skill automatically reads task information from the agent's `memory/` directory and calendar, places it into `WEEKLY_TODO`, and sends the resulting message to a configured messaging channel. There is no documented filtering of sensitive event titles, attendees, locations, medical appointments, work details, or private notes. There is also no destination-level check ensuring the configured target is a private direct-message channel. The configuration permits Discord, Telegram, Feishu, or `last`, and channel bindings can cover an entire bot account. The disclosure is not an attacker-controlled remote exfiltration endpoint in the audited repository. Nevertheless, it is an unsafe cross-boundary data flow from local private sources to an external messaging destination. ### Attack Path 1. The user enables the daily initialization cron task. 2. Personal tasks or calendar events are available through `memory/`, a calendar integration, or Apple Reminders. 3. At 06:00, the initialization agent reads those sources to populate `WEEKLY_TODO`. 4. The entire morning template is assembled. 5. The agent sends the message to the channel specified in `MEMORY.md`. 6. If the d ...[truncated 705 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable calendar, reminder, and memory inclusion by default. 2. Require explicit, informed opt-in before reading or sending personal task data. 3. Restrict automated summaries to a verified private direct-message destination. 4. Do not use `last` for messages containing private information. 5. Add destination validation and require confirmation if the destination changes. 6. Redact event locations, attendees, notes, URLs, account identifiers, and sensitive categories. 7. Provide a configurable allowlist of calendar sources and fields. 8. Prefer a generic count such as “three tasks today” over event titles. 9. Add a preview/test mode showing exactly what data will be sent and where. 10. Skip the task section entirely when privacy cannot be established. 11. Ensure group-channel handling never loads or transmits private memory or calendar content. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: openclaw.example.json5:5
• Finding: Global Recurring Heartbeat Causes Cross-Agent Unsolicited Messaging<![CDATA[ ## Vulnerability Details **File Location**: `openclaw.example.json5:5-14`; related behavior in `engine/HEARTBEAT.md:31-45` **Vulnerability Type**: Overbroad persistent agent configuration and recurring outbound behavior **Risk Level**: High ### Vulnerable Code ```json5 agents: { // Heartbeat is global and affects every agent defaults: { heartbeat: { every: "30m", // "last" sends to the most recently active session target: "last", activeHours: { start: "06:00", end: "23:59" }, }, }, ``` The heartbeat instructions mandate recurring content: ```markdown ## 💬 日常闲聊（角色扮演） 根据 SOUL.md 的人物性格特征，结合之前的对话内容，以及当前的日期时间、节日、天气、新闻等信息，主动发一些符合情境的话，或者闲聊，一到两句话即可。 **这部分也发到消息频道**。 ## 📸 每次心跳附带照片 **重要**：每次心跳都要生成并发送一张照片！ - **当 `enabled === false`**：仅使用 SFW 场景 - **当 `enabled === true`**：根据当前角色扮演状态生成，可按状态使用 NSFW 工作流 - 按 `TOOLS.md` 配置的生图工具生成 - 与消息一起发送到消息频道 ``` ### Technical Analysis The example installs the heartbeat under `agents.defaults`, so it is global rather than scoped to the `role-play` agent. The file itself acknowledges that this affects all agents. The heartbeat fires every 30 minutes for up to 18 hours per day and targets `last`, which is mutable context rather than a fixed, verified roleplay destination. `HEARTBEAT.md` then requires proactive messaging and an image on every event. When the game is enabled, the instructions permit NSFW workflows. This contradicts the installation claim that creating the separate roleplay agent does not affect existing agents. It also exceeds least scope: a daily roleplay feature does not require global heartbeat behavior for unrelated agents. ### Attack Path 1. The user copies the example configuration into the global OpenClaw configuration. 2. The `agents.defaults.heartbeat` setting becomes active for all agents. 3. OpenClaw triggers heartbeat events every 30 minutes during the configured active hours. 4. The current agent processes its heartbeat instructions. 5. Roleplay messages and ...[truncated 1008 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Move heartbeat configuration from `agents.defaults` to the individual `role-play` agent. 2. Use a fixed, explicitly verified roleplay channel instead of `target: "last"`. 3. Keep heartbeat disabled by default and require explicit user opt-in. 4. Separate messaging opt-in from NSFW image-generation opt-in. 5. Add minimum intervals, daily message caps, and model/image cost limits. 6. Suppress heartbeats when there has been no recent roleplay interaction. 7. Require explicit confirmation before enabling proactive NSFW content. 8. Provide clear enable, pause, and uninstall instructions. 9. Ensure setup does not alter global defaults for existing agents. 10. Document that scheduled initialization and heartbeat automation are optional rather than required. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (110)

Ae1

High

• Category: analysis-evasion

Content

6. **定时任务** — 添加 6:00 初始化 + 23:30 收尾归档（见 docs/CRON_CONFIG.md）

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

�执行历史
openclaw cron remove <job-id>   # 删除任务
```

---

## 系统 Crontab（备选）

如不使用 OpenClaw cron，也可用系统 crontab 直接调用收尾脚本：

```bash
30 23 * * * <workspace-path>/scripts/wrapup.sh >> /tmp/roleplay-wrapup.log 2>&1
```

将 `<workspace-path>` 替换为实际 workspace 路径（如 `~/.openclaw/workspace-role-play`）。

**注意**：系统 crontab 只能执行 shell 脚本（收尾归档），无法触发 agent 执行初始化。每日 6:00 初始化必须通过 OpenClaw cron 或心跳手动触发。

---

## 前置条件

- 脚本已可执行：`chmod +x <workspace-path>/scripts/wrapup.sh`
- 目录权限正常
- OpenClaw Gateway 运行中（使用 OpenClaw cron 时）

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Ssd 4

High

• Confidence: 98% confidence
• Finding: The workflow explicitly ties hidden sexual content to progressive rewards and penalties, including '脱衣+拍照' and stateful tracking of guesses, while forbidding disclosure of the underlying hidden state. This increases the risk of manipulative sexualized interaction, covert collection of intimate preference data, and escalation into non-consensual or unclear-consent behavior—especially because state is persisted and the user may not understand how the hidden mechanics operate.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README states that all daily data and images are automatically archived, but it does not disclose retention duration, storage location, access controls, or disk usage implications. In a skill that handles sensitive roleplay content and generated images, silent archival increases privacy risk and can expose intimate material if the workspace is shared, backed up, or later exfiltrated.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The setup instructions say the script will automatically create an agent and workspace without clearly warning the user about filesystem changes or what resources will be modified. While this is common for installer scripts, undisclosed automation increases the chance of unintended local changes and makes review/consent weaker, especially in agent ecosystems that may have broad file access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README instructs users to place personal information and messaging-channel details into local files but provides no privacy or handling warning. Because this skill centers on sexual roleplay content and may integrate with messaging platforms and image tools, storing identity, preferences, and channel metadata in plaintext can materially increase exposure of sensitive personal data.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises shell, file read, and file write behavior via setup and maintenance scripts, but it does not declare an explicit tool scope or permissions boundary. That increases the chance an agent or user invokes filesystem and shell-capable actions without clear least-privilege constraints, especially because the skill installs files into the home directory and creates a separate workspace.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs users to run setup scripts that create an agent, copy files, initialize runtime state, and deploy into ~/.openclaw/workspace-role-play, but it does not prominently warn that these commands modify the local filesystem. This can lead to unexpected persistence, overwriting of files, or unsafe execution of cloned scripts with the user's privileges.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill describes scheduled generation, archival, and outbound message/image sending, but it does not clearly warn users that data will be persisted and may be transmitted to external services or channels. In this context, the content includes highly sensitive sexual-roleplay metadata, making undisclosed storage and transmission more risky than a typical game skill.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This YAML contains user-facing natural-language fields such as comments, names, descriptions, rewards, and bonuses exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation, and this file does not indicate that the skill is intentionally region-specific or that users may choose another language.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This YAML file’s natural-language comments, labels, and examples are all in Chinese, effectively forcing a specific language/locale for anyone using or maintaining the skill. The policy allows locale constraints only when they are optional or clearly justified, but this file provides no user choice or justification for the language restriction.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This YAML manifest uses Chinese throughout comments and natural-language descriptions, effectively forcing a specific language for users or maintainers who interact with the skill metadata. The file does not indicate that the skill is China-specific or provide any opt-in or alternative locale, which matches the language/locale policy violation criteria.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest explicitly instructs the system to ingest a user's schedule/todo data from external personal sources and use that information to influence roleplay generation. That creates unnecessary collection and secondary use of private data for a sexualized entertainment feature, increasing privacy risk and the chance of overcollection beyond what is needed for core functionality.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The instruction to read a user's daily schedule/todo summary and feed it into content generation is a plain-language directive to process private personal data. In this skill's context, that data is used to personalize NSFW roleplay outputs, which heightens sensitivity and creates privacy, consent, and data-minimization concerns.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The generation flow operationalizes collection and reuse of schedule/todo data to steer model behavior, turning personal planning information into a personalization signal. Because the skill is a roleplay engine with sexual-content elements, this secondary use materially increases the privacy sensitivity of the data handling.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The file content is entirely authored in Chinese and contains no mechanism for locale negotiation, fallback text, or user opt-in, so users who do not understand that language may receive opaque or misleading sexualized prompts. In this skill’s context, that is more dangerous than a normal localization issue because the content drives roleplay behavior and consent-adjacent interactions; misunderstanding the prompts can cause inappropriate or unexpected sexual content generation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: This YAML file’s natural-language fields, including the category, description, and all hint text, are entirely in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in is a violation unless the locale restriction is explicitly documented and justified, which is not present here.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The keyword set at this location includes a very broad standalone trigger related to common clothing terminology, which can cause accidental matches during user input parsing. In this skill, that is more dangerous because the system is explicitly built around hidden sexual-fetish guessing; generic clothing words can unintentionally route ordinary conversation into sexualized game logic or explicit content generation.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This location contains an especially generic standalone keyword that can match ordinary references to accessories or clothing in non-sexual contexts. Given this roleplay engine's explicit sexualized domain, such overbroad matching increases the risk of misclassification, unintended NSFW escalation, and inappropriate responses from downstream image or roleplay components.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The entire skill content, including category names, descriptions, hints, and keywords, is written only in Chinese with no indication that users may choose another language or locale. This can violate a language/locale policy when a skill is expected to support user preference or provide explicit opt-in for a fixed language.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This YAML file contains user-facing natural-language descriptions, hints, and keywords entirely in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This manifest/config file contains natural-language strings and comments exclusively in Chinese, including all user-facing hint text. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is clearly documented and justified, which is not present here.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The natural-language comments and operational descriptions are written entirely in Chinese, which indicates a fixed language/locale expectation with no opt-in or alternative language path. Under the policy rule, forcing a specific language without user choice or a documented region-specific justification is a violation.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s user-facing content is entirely in Chinese and provides no indication that the skill is limited to Chinese-speaking users or that language selection is configurable. In a general-purpose agent skill, this can cause users to misunderstand roleplay instructions, generated traits, or safety-relevant nuances, leading to incorrect consent, misuse, or failure to understand system behavior.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This YAML file contains all user-facing descriptive text in Chinese, including the description, names, hints, and comments, with no indication that language selection is optional or constrained to a Chinese-specific deployment. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.