Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent product-video scripting helper with disclosed video handoff behavior and no hidden code, persistence, or credential handling.
Installers should expect a Chinese-leaning ecommerce video workflow and should review generated prompts before sending product images to any external video tool. Video generation is supposed to occur only after an explicit user request, and the no-subtitle/no-text requirement should be checked during handoff.
The default prompt hard-codes several Chinese-language video directions and style labels, which imposes a language/locale choice in the skill's natural-language behavior. The file does not indicate that users can choose their preferred language or locale, nor does it justify this as a region-specific skill.
This playbook presents required content patterns in a bilingual but fixed-language format, with multiple sections labeled only in Chinese and operational guidance in English. Because the file does not state that users may choose their preferred language or locale, it can be read as enforcing language conventions without opt-in.
The template includes mandatory Chinese text for campaign context, which imposes a specific language choice in user-facing output. This is a natural-language policy concern because the file does not indicate user opt-in or an alternative locale selection.
The listed direction options are presented in Chinese as the default user-facing choices, with no indication that the user can choose another language. This creates a locale constraint that is not documented as optional or region-specific.
The required fallback sentence for unavailable research is specified only in Chinese, making the template enforce a particular language in generated responses. The file does not offer an opt-in, alternate locale, or justification for the restriction.
The exact required next-step options are hard-coded in Chinese and are explicitly described as user-facing labels. Because no alternative language path or opt-in is provided, the template effectively forces a single locale.
The file requires a fixed first sentence in Chinese for the video handoff prompt, which imposes a specific language on downstream output. The policy allows locale constraints only when user choice is offered or the constraint is clearly documented and justified; neither is present here.
These sections require exact Chinese-language constraint lines for non-TVC, audio, and no-text behavior. Because they are mandatory and not framed as optional or region-specific, they create a language policy violation for users operating in other languages.
The TVC workflow repeats the same pattern by requiring a fixed Chinese opening sentence for every submitted prompt. This enforces a locale choice across all uses of the skill rather than adapting to user preference or documented regional scope.
The regeneration guidance includes 'more restrained text overlay,' which directly contradicts the file’s repeated no-subtitles/no-text-overlay policy. In practice, this inconsistency can cause downstream agents or tools to reintroduce on-screen text that the skill otherwise promises to forbid, creating policy drift and unreliable safety/compliance behavior.
No suspicious patterns detected.
