Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only frontend architecture guidance skill with no hidden execution, credential handling, or system persistence.
Installers should treat this as frontend architecture guidance, not a security-sensitive automation skill. Review the generated UI copy and theme requirements for your project's language and product needs before applying them wholesale.
The trigger examples are broad natural-language phrases that could match ordinary project discussions rather than an explicit request to invoke this specific skill. In an agent ecosystem, underspecified activation criteria can cause unintended invocation, leading to inappropriate architectural guidance being injected into workflows or chaining into downstream actions without clear user intent.
The markup hard-codes the accessible label and button text in Chinese ("选择主题", "浅色", "深色", "系统") with no indication that the skill is intentionally region-specific or that users can opt into another language. This is a natural-language locale policy concern because the file otherwise appears to be a general CSS architecture reference rather than a China-specific artifact.
The phrase "Every new project must include light/dark/system theme toggle" imposes a specific UX/locale-related behavior by default rather than offering it as a user or project choice. Under the policy rule, forced preference handling without opt-in or justification can be a natural-language policy issue.
The example UI includes Chinese labels ('已上线', '主操作', '次操作') embedded in an otherwise English document, but the file does not state that the skill is intentionally region-specific or that language should be user-selectable. Under the policy, forcing or implying a specific locale without opt-in can be a natural-language policy issue.
No suspicious patterns detected.
