Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language text adventure skill whose file access and save-state changes are expected for gameplay and do not show hidden or unsafe external behavior.
Install this if you want a Chinese-language, stateful text RPG. Expect it to read bundled chapter files and update a local game_state.md save file during play; back up that file if you care about preserving a particular run.
The skill allows destructive state changes when the player's input is ambiguous, automatically deleting the 'least important' item after only a warning. In an agentic system, ambiguity can arise from parsing errors, localization issues, or prompt manipulation, causing irreversible loss of user assets without informed consent.
This markdown file uses Chinese throughout the description and gameplay instructions, effectively forcing a specific language for users without documenting an opt-in or alternative locale. Under the stated policy, language constraints should either be user-selectable or clearly justified as region-specific.
The skill explicitly instructs the agent to read and modify game_state.md, including initializing and overwriting character, inventory, biography, and current progression state, without requiring explicit user confirmation or warning that a save file will be changed. In a stateful agent environment, this creates an integrity risk: a user may trigger the skill expecting narrative output, while the skill silently alters persistent data and could overwrite prior progress or create unintended saves.
Line L439 states that all content must be in Chinese, which imposes a fixed language policy on the user. The file does not indicate any user opt-in, alternative locale support, or justification for this restriction as a region-specific skill.
The manifest description is written entirely in Chinese, and the file content consistently presents the skill in Chinese without offering a language choice or documenting that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when users are not given an explicit opt-in or alternative locale.
The file’s natural-language description and section content are entirely in Chinese, and there is no indication that the skill supports other languages or that Chinese is a required locale. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.
The manifest description and heading specify the skill entirely in Chinese, and the instructions consistently prescribe Chinese-language outputs without offering a language choice. Under the policy rule, forcing a specific language is a natural-language locale violation unless the constraint is optional or clearly justified as region-specific.
This markdown skill uses Chinese throughout its description, instructions, scenarios, and notes, but does not state that the skill is intended only for Chinese-speaking users or provide any opt-in language choice. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy violation.
The file's natural-language description and operating instructions are presented in Chinese, which effectively imposes a language choice on users and integrators. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which is present here.
The teammate-leave flow performs irreversible deletion of all companion inventory items as a default action, while the warning to the player is described as informational rather than a required precondition or safeguarded workflow. This creates avoidable data loss risk if the trigger is incorrect, premature, or spoofed by another system component.
The note states that high-value items must be explicitly confirmed before being discarded and that inherited items will not be auto-discarded. However, the main acquisition flow says that if player input is unclear, the system will warn and then automatically discard the currently least important item, which can still conflict with the stated confirmation requirement for valuable items depending on inventory composition and the flexible priority rules.
The description and all user-facing interaction examples are presented in Chinese, which effectively forces a specific language for the skill experience. There is no indication that the user can choose another language or that the locale restriction is intentional and documented as region-specific.
The description and all user-facing content in this markdown file are written in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. Under the policy, language-specific behavior should either be optional for the user or clearly justified as region-specific.
The file’s description and primary heading are written entirely in Chinese, which implies a fixed language experience. There is no accompanying note that the skill is Chinese-only by design, region-specific, or that users may choose another language.
The functional description lists player inventory management, companion inventory management, add/drop operations, capacity handling, and sorting, but does not define transfer operations between the two inventories. Later, the notes assert that items can be transferred between player and companion backpacks, which introduces a documented capability not covered by the earlier command set or procedures.
No suspicious patterns detected.
