Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local code-review visualization helper and I found no hidden execution, credential use, network retrieval, or persistence.
Use this skill when you are comfortable letting the agent read the code or diffs you ask it to visualize and create local HTML reports. For untrusted diffs, make sure generated report content is escaped before opening it in a browser, and avoid placing credentials or sensitive source snippets in shareable reports.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- 风险标签 -->
<span class="risk risk-safe">🟢 safe</span>
<span class="risk risk-worth">🟡 worth a look</span>
<span class="risk risk-attention">🔴 needs attention</span>
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</head>
<body>
<!-- ═══════════════════════════════════════════
CONTENT STARTS HERE
Replace this section with actual content
═══════════════════════════════════════════ -->
The template sets <html lang="zh-CN">, which forces a specific language/locale for rendered content. Under the policy, locale-specific behavior should either be user-selectable or clearly documented as a justified regional constraint.
The natural-language instructions throughout the skill are presented in Chinese, which can amount to a language policy constraint if users are not given a choice of output language. The file does not state that Chinese is optional, user-selected, or required for a justified regional context.
This markdown file documents a behavior where the skill will write generated HTML to files when canvas is unavailable, and may split output into multiple files. The description does not include any explicit user warning about local file creation, output paths, or avoiding overwriting existing files, which is a user-impacting filesystem operation.
No suspicious patterns detected.