Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a Google Fonts guidance skill, but its broad triggers and tool authority are not scoped tightly enough for that purpose.
Review this skill before installing. It appears non-malicious and mostly provides Google Fonts advice, but its invocation rules should be narrowed to font selection, loading, fallback stacks, and frontend performance, and its tool access should be limited to what those tasks actually require.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
<!-- 双 preconnect + display=swap -->
<link rel="preconnect" href="https://fonts.googleapis.com">
gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700&display=swap" rel="stylesheet">
The trigger is overly broad and explicitly targets content-creation use cases outside the skill’s domain. Over-broad routing is dangerous because it can cause automatic or heuristic invocation of this skill in unrelated sessions, expanding attack surface and enabling confused-deputy behavior with its declared tool access.
The description states '支持中文交互' in a way that presents Chinese as the interaction mode, and the document does not clearly offer a language choice or opt-in mechanism. Under the policy, language or locale constraints should be optional or explicitly justified.
The skill is declared as a narrow Google Fonts helper, but the body introduces generic create/query/modify/delete, import/export, save, and convert behaviors that are unrelated to font loading guidance. This kind of scope expansion can cause an agent to over-trust the skill for tasks outside its stated purpose, increasing the chance of unintended tool use or unsafe delegation.
The trigger conditions say to use the skill for marketing copy, title optimization, and content creation, which conflicts with the declared developer-focused font tool purpose. A mismatched trigger increases the likelihood that an agent invokes this skill in unrelated contexts, where its instructions and tool permissions may be inappropriate or misleading.
The document states no extra API key is required, yet the security section advises configuring API keys via environment variables. This inconsistency can confuse users about secret handling, leading them to provision or expose credentials unnecessarily in a skill that should not require them.