Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Chinese idiom social-post generator that creates a local markdown draft, with no evidence of credential access, networking, hidden execution, or destructive behavior.
Installers should expect the skill to generate Chinese social-post copy and save a markdown draft locally. Consider narrowing the trigger and confirming the filename before saving if accidental invocation or workspace clutter matters.
The trigger list includes a very broad phrase, "chengyu", which can overlap with ordinary multilingual conversation and unintentionally activate the skill outside the user's clear intent. This can cause unexpected execution of the skill workflow and, in this case, chain into automatic content generation and file-writing behavior without sufficiently explicit invocation.
The skill instructs the agent to write generated content directly to output/xhs-{成语名}.md without any prior user-facing disclosure or confirmation. Unannounced file creation is risky because it can surprise users, clutter workspaces, and combine with accidental triggering to perform state-changing actions the user did not clearly authorize.
No suspicious patterns detected.
