Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a diagram-generation skill, but its documentation requests broad read, write, and command execution capabilities without clear boundaries.
Review this skill carefully before installing. It does not show malicious code, but it asks for broad read/write/exec tool access while giving unclear, template-like instructions. Install only if you are comfortable limiting it to explicit diagram-generation tasks and reviewing any proposed file writes, command execution, or API-key use.
The manifest description starts as a dark-themed SVG diagram generator, then continues with data analysis, reporting, statistical insight, and data visualization guidance. This combines two different skill intents in a way that contradicts the declared identity of the skill and suggests the documentation was copied from another skill.
The description says to use the skill for broad categories like design creation, UI design, poster production, brand visuals, data analysis, report generation, statistical insights, and data visualization. These scopes are expansive and vague for a diagram-generation skill, making it unclear when this skill should activate versus other unrelated creative or analytics skills.
The description explicitly states '支持中文交互，无需复杂配置即开即用' while the document otherwise mixes Chinese and English and does not clearly present language choice as optional. This can be interpreted as imposing a language/locale behavior without explicit user opt-in.
The setup instructions only say to call the skill in an AI Agent conversation and provide necessary input parameters, but they do not define concrete trigger phrases, scope boundaries, or examples of when not to invoke it. In a markdown skill file, this can lead to unintended invocation because the activation conditions are underspecified.
The skill is described as a diagram generator for architecture, flowchart, and sequence diagrams, but the scenario table says the input is "用户请求数据" and the output is "结构化处理结果" for both cases. That documentation reads like a generic data-processing skill rather than a diagram generator, which conflicts with the stated intent.
The FAQ and description repeatedly state that the skill generates SVG diagrams, but the explicit output example shows a generic JSON object with fields like "result", "status", and reviewer-style metadata instead of SVG content or a diagram artifact. This is an active contradiction in the documentation about what the skill returns, not merely missing detail.
No suspicious patterns detected.
