Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a real HTML report generator, but it needs review because it can auto-activate broadly, use web search, write persistent template files, and run a local screenshot command with unclear scoping.
Install only if you are comfortable with a report-generation skill that may automatically start on common report/HTML requests, search the web for supporting data, write generated HTML files, and possibly create persistent design-system files. Prefer using it in a workspace where report outputs and any validation scripts are controlled and reviewable.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- 数字/百分比 → <b> -->
<b style="color:var(--t);">97%</b>
<!-- 公式/代码 → <em>（等宽主色）-->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- 数字/百分比 → <b> -->
<b style="color:var(--t);">97%</b>
<!-- 公式/代码 → <em>(等宽主色)-->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<path d="M0,0 L0,6 L6,3 z" fill="#475569"/>
</marker>
</defs>
<!-- 中心系统 -->
<rect x="245" y="74" width="210" height="70" rx="6" fill="var(--p)" opacity="0.9"/>
<text x="350" y="103" text-anchor="middle" font-size="12" font-weight="800" fill="#fff">核心系统</text>
<text x="350" y="120" text-anchor="middle" font-size="9" fill="rgba(255,255,255,0.75)">[Software System]</text>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<text x="350" y="24" text-anchor="middle" font-size="11" fill="var(--mt)">👤</text>
<text x="350" y="44" text-anchor="middle" font-size="9" font-weight="600" fill="var(--t)">最终用户</text>
<text x="350" y="54" text-anchor="middle" font-size="8" fill="var(--dt)">[Person]</text>
<!-- 用户→系统箭头 -->
<line x1="350" y1="58" x2="350" y2="74" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
<text x="360" y="68" font-size="7.5" fill="#64748b">使用</text>
<!-- 外部系统（左） -->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<text x="350" y="24" text-anchor="middle" font-size="11" fill="var(--mt)">👤</text>
<text x="350" y="44" text-anchor="middle" font-size="9" font-weight="600" fill="var(--t)">最终用户</text>
<text x="350" y="54" text-anchor="middle" font-size="8" fill="var(--dt)">[Person]</text>
<!-- 用户→系统箭头 -->
<line x1="350" y1="58" x2="350" y2="74" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
<text x="360" y="68" font-size="7.5" fill="#64748b">使用</text>
<!-- 外部系统(左) -->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- 左←→中 -->
<line x1="160" y1="109" x2="245" y2="109" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
<text x="200" y="104" text-anchor="middle" font-size="7.5" fill="#64748b">调用API</text>
<!-- 外部系统（右） -->
<rect x="540" y="89" width="130" height="40" rx="4" fill="rgba(255,255,255,0.04)" stroke="rgba(255,255,255,0.15)" stroke-width="1" stroke-dasharray="4,3"/>
<text x="605" y="107" text-anchor="middle" font-size="9.5" font-weight="600" fill="var(--mt)">外部服务 B</text>
<text x="605" y="120" text-anchor="middle" font-size="7.5" fill="var(--dt)">[External System]</text>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- 左←→中 -->
<line x1="160" y1="109" x2="245" y2="109" stroke="#475569" stroke-width="1.5" marker-end="url(#c4-arr)"/>
<text x="200" y="104" text-anchor="middle" font-size="7.5" fill="#64748b">调用API</text>
<!-- 外部系统(右) -->
<rect x="540" y="89" width="130" height="40" rx="4" fill="rgba(255,255,255,0.04)" stroke="rgba(255,255,255,0.15)" stroke-width="1" stroke-dasharray="4,3"/>
<text x="605" y="107" text-anchor="middle" font-size="9.5" font-weight="600" fill="var(--mt)">外部服务 B</text>
<text x="605" y="120" text-anchor="middle" font-size="7.5" fill="var(--dt)">[External System]</text>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
</marker>
</defs>
<!-- 层1：表现层 -->
<rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
<text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6">PRESENTATION</text>
<rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<path d="M0,0 L0,6 L6,3 z" fill="#64748b"/>
</marker>
</defs>
<!-- 层1:表现层 -->
<rect x="0" y="0" width="940" height="52" rx="4" fill="rgba(59,130,246,0.1)" stroke="rgba(59,130,246,0.3)" stroke-width="1"/>
<text x="10" y="14" font-size="9" font-weight="700" fill="#3b82f6">PRESENTATION</text>
<rect x="120" y="8" width="140" height="34" rx="4" fill="rgba(59,130,246,0.2)" stroke="rgba(59,130,246,0.4)" stroke-width="1"/>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<svg viewBox="0 0 140 80" style="width:140px;height:80px;flex-shrink:0;" xmlns="http://www.w3.org/2000/svg">
<defs>
<!-- 轨道渐变：绿→黄→红 -->
<linearGradient id="gaugeTrack" x1="0" y1="0" x2="1" y2="0">
<stop offset="0%" stop-color="#10b981"/>
<stop offset="50%" stop-color="#f59e0b"/>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<svg viewBox="0 0 140 80" style="width:140px;height:80px;flex-shrink:0;" xmlns="http://www.w3.org/2000/svg">
<defs>
<!-- 轨道渐变:绿→黄→红 -->
<linearGradient id="gaugeTrack" x1="0" y1="0" x2="1" y2="0">
<stop offset="0%" stop-color="#10b981"/>
<stop offset="50%" stop-color="#f59e0b"/>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<rect x="0" y="0" width="140" height="70"/>
</clipPath>
</defs>
<!-- 灰色背景轨道（半圆） -->
<circle cx="70" cy="70" r="52" fill="none" stroke="rgba(255,255,255,0.06)"
stroke-width="12" clip-path="url(#topHalf)"/>
<!-- 彩色量程轨道 -->
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<rect x="0" y="0" width="140" height="70"/>
</clipPath>
</defs>
<!-- 灰色背景轨道(半圆) -->
<circle cx="70" cy="70" r="52" fill="none" stroke="rgba(255,255,255,0.06)"
stroke-width="12" clip-path="url(#topHalf)"/>
<!-- 彩色量程轨道 -->
The description includes very broad trigger phrases such as '生成报告', '做成HTML', and '内容可视化', plus '无需确认直接生成', making the skill likely to auto-activate for many ordinary user requests. Over-broad invocation increases the chance that the agent enters this powerful workflow unexpectedly, including its network and file-authoring behaviors, without clear user intent or consent.
This markdown file is entirely written as a Chinese-language design specification and does not indicate that other languages are supported or that the language choice is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in is a reportable issue unless the locale restriction is explicitly documented and justified.
This file says it must only be used after workflow expansion and explicit user confirmation, which conflicts with the skill metadata stating the skill should generate immediately without confirmation. Conflicting control-flow requirements are dangerous because they can cause the agent to behave unpredictably around consent boundaries, either skipping required approval or blocking unexpectedly; for a skill that may read files and generate content automatically, ambiguity around confirmation increases the risk of unintended actions.
The mandatory user-confirmation language directly contradicts the skill's documented intent to run immediately without confirmation. Such contradictions weaken policy enforcement and make it easier for downstream prompts or implementations to choose whichever path is more permissive, leading to consent bypass or inconsistent execution. In an auto-triggered skill, this inconsistency is more dangerous because the user may not realize when additional gated steps should have applied.
The file instructs the agent to create new design-system files with a Write tool when a style file is missing. That expands the skill from HTML report generation into repository mutation, which can cause unauthorized file creation, persistence of attacker-influenced content, and violation of least-privilege expectations for users invoking a presentation/report skill. In this skill context, that is more dangerous because the manifest frames the capability as report generation, so users are less likely to expect side effects on the filesystem.
The document title and all operational instructions are written exclusively in Chinese, and the skill defines mandatory generation behavior for each page without offering any language or locale choice. This can violate language/locale policy when the skill is used in contexts where users have not opted into Chinese output.
The entire skill file is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.
This markdown file contains operational instructions exclusively in Chinese, and there is no natural-language indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern.
This markdown file presents all operational instructions exclusively in Chinese, including mandatory workflow steps and quality gates. Under the policy rule for language or locale constraints, forcing a specific language without offering user choice or documenting a justified regional scope is a natural-language policy violation.
The workflow explicitly requires using web_search to verify topic data before generating HTML, which expands the skill from presentation/report generation into external network research. That broadens permissions and data flow, increasing the chance of unintended outbound queries, privacy leakage of user-provided topics, and dependency on live external content not strictly necessary for core report rendering.
The workflow instructs execution of a Node.js command (node screenshot_batch.js) as part of output validation, introducing code execution beyond what is needed for HTML generation. Any workflow that normalizes running local scripts increases attack surface because a modified script, dependency, or path could execute arbitrary code or access local files during validation.
The checklist mandates '联网核实数据已完成', which expands the skill from HTML report generation into external data retrieval and verification. That creates scope creep: the agent may access network resources, process untrusted external content, and present fetched data as validated, increasing the risk of unintended data exfiltration, prompt injection exposure, or actions beyond the declared skill purpose.