Security audit
Security checks for vulnerabilities and agentic risk
This skill is a small button-prompt helper; the main issue is an extra hard-coded Chinese confirmation message, not a security threat.
Reasonable to install if you want Telegram-style prompt buttons. Review the hard-coded follow-up message and memory/subagent guidance if you need strict localization, quiet message behavior, or tight control over background work.
The helper always sends the confirmation text in Chinese: '已发送按钮，请点数字选择。'. This imposes a specific language on all users with no configuration, negotiation, or documented locale constraint, which is a natural-language policy violation under the language/locale rule.
The file comment says the helper 'sends buttons and a short confirmation,' which implies a neutral acknowledgement. The actual code sends the specific message '已发送按钮，请点数字选择。' directing the user to choose by number, which is a stronger behavior than a generic confirmation and may be channel-inappropriate when inline buttons are available.
The manifest describes a helper that wraps prompts with tappable button menus or numbered-list fallbacks. This code not only sends the button prompt but also unconditionally sends a second confirmation message, which is additional user-facing behavior not implied by the stated purpose of merely wrapping prompts.
No suspicious patterns detected.
