Security audit
Security checks for vulnerabilities and agentic risk
This is a narrowly scoped Bahasa Aceh writing and review skill with no executable code, persistence, credential handling, or hidden system changes.
Install this if you want help drafting or reviewing Bahasa Aceh text. Treat outputs as source-aware drafts, especially for public, ritual, legal, educational, or official use, and have important wording checked by a competent speaker or Balai Bahasa resource.
The default prompt hard-codes an activation phrase and a specific transformation goal in a fairly broad way, which can cause the skill to be invoked for generic text-adaptation tasks rather than clear Acehnese-specific requests. This is mainly a safety and routing issue: users may get unintended language conversion or regionalized output without explicit confirmation.
The default prompt instructs use of the skill to adapt text into a Bahasa Aceh regional register without indicating that this should happen only when the user chooses that locale. That can override user preference, create misleading outputs, or apply a regional language transformation where standard Indonesian or another target language was expected.
The generation rule says to "Build the meaning in clear Indonesian first," which imposes a specific language workflow regardless of the user's preferred language. This is a natural-language policy concern because it mandates a locale/language choice without offering opt-in or an alternative.
The purpose statement says the skill supports generation and review for Bahasa Aceh, which establishes a language-specific constraint. Because the file does not explicitly state that users may choose another language or opt into Acehnese output, this can be read as forcing a locale/language behavior without user choice.
The file explicitly sets the skill language to Aceh and constrains the regional context to Aceh/Acehnese communities, but it does not state that this locale is user-selectable or optional. Under the policy rules, a fixed language/locale without opt-in or explicit justification can constitute a natural-language policy violation.
