✓
Purpose & Capability
Name/description claim a local emoji translator and the included Python script implements exactly that with local mapping tables and no network calls or unrelated dependencies. Mappings support Chinese and English as advertised.
ℹ
Instruction Scope
SKILL.md usage and parameters are limited to translating text and show no steps that read external files, env vars, or contact external endpoints. However the pre-scan flagged 'unicode-control-chars' in SKILL.md — invisible characters (e.g., directionality controls) can be used for prompt-injection or to obscure content; inspect the raw SKILL.md bytes to confirm none are present or malicious.
✓
Install Mechanism
No install spec or external downloads are declared. The skill bundles a small Python script (no third-party imports) — low installation risk and nothing is fetched from external URLs.
✓
Credentials
No environment variables, credentials, or config paths are requested. The script only reads CLI args/stdin and prints output; required privileges appear minimal and proportionate.
✓
Persistence & Privilege
Skill does not request always:true, does not modify other skills or system settings, and does not persist credentials. Autonomous invocation is allowed by platform default (no additional privilege requested).
Scan Findings in Context
[unicode-control-chars] unexpected: SKILL.md was flagged for unicode control characters. An emoji translator does not need hidden directional or control characters; this could be an attempt to hide or manipulate displayed content. The code file does not show use of such characters, but you should inspect the raw SKILL.md bytes (look for U+202A..U+202E, U+2066..U+2069, etc.) before trusting the skill.
What to consider before installing
The bundled Python script implements a straightforward local text↔emoji mapping and appears consistent with the skill description. Before installing: (1) open the SKILL.md in a hex-capable editor and check for invisible unicode control chars (RLO, LRE, FSI, PDF, etc.); remove them if present. (2) Review scripts/emoji_translator.py yourself or run it in a sandboxed environment to confirm it only does local string operations and prints results. (3) Test with non-sensitive input to confirm behavior. If you find hidden control characters or any unexpected network activity when running the script, do not install. If you are not comfortable inspecting files, treat this as untrusted until verified.
