Security audit
Security checks for vulnerabilities and agentic risk
This skill appears incomplete and Chinese-only, but the inspected artifacts do not show hidden execution, data theft, persistence, or destructive behavior.
Before installing, expect a Chinese-language and likely incomplete package: the visible entrypoints require local HERMES modules that are not included. From a security standpoint, the reviewed files are low risk, but users who need working functionality or English documentation should verify the package contents and usability first.
The natural-language content and examples are presented only in Chinese, which effectively forces a specific language for users without any opt-in or alternative locale guidance. The policy explicitly calls for flagging language or locale constraints unless the skill offers a user choice or clearly documents a justified regional limitation.
This code includes multiple user-facing strings in Chinese, such as the banner, usage text, and command descriptions, but provides no opt-in or alternative language option. That can violate language/locale policy because the skill forces a specific language for all users regardless of preference.
This JavaScript file contains natural-language comments and console output entirely in Chinese, including user-visible runtime messages. Under the stated policy, forcing a specific language without opt-in is a locale-policy violation unless the constraint is explicitly justified, which is not present here.
The package description is written entirely in Chinese, which indicates a fixed language presentation without any opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a natural-language locale violation unless it is clearly documented as region-specific or optional.
This code file contains multiple user-facing natural-language strings in Chinese, including the title comment and console output, with no indication that the user can choose another language or that the skill is region-specific. That creates a locale-policy concern under the rule for language or locale restrictions without opt-in.
No suspicious patterns detected.
