Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent matplotlib chart-generation helper with no evidence of hidden execution, credential access, networking, persistence, or destructive behavior.
Install this if you want matplotlib report-style chart templates. Review or adjust generated output paths before running example scripts, and expect to change the hard-coded macOS font path if you are not on macOS or do not need Chinese labels.
The skill description is written as operating in Chinese and the examples and guidance consistently assume Chinese-language usage, including Chinese font handling guidance later in the file. There is no statement that users may choose another language or locale, which can violate language-choice policy for general-purpose skills.
The README includes a very broad invocation example ('帮我根据这张表自动选择合适图表并输出 matplotlib 代码') in a skill whose trigger keywords already cover generic charting terms. In an agent environment, this can cause the skill to activate for many ordinary data/plot requests, potentially overriding more appropriate tools or causing unintended routing behavior.
The trigger description and keyword list are broad enough to activate this skill for many generic requests involving charts, plotting, or data graphics, even when the user did not specifically ask for this exact workflow. Over-broad activation can cause unintended routing, reducing user control and increasing the chance that the skill imposes its own constraints or style assumptions in unrelated contexts.
The skill hard-codes Chinese language/font behavior and a macOS-specific system font path without checking the user's language preference, locale, or runtime environment. This can force undesired output language, break portability on non-macOS systems, and cause failures or degraded rendering when the font is unavailable.
The file’s natural-language strings and usage description are entirely in Chinese, and there is no indication that the skill is region-specific or that users may opt into another language/locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
The module docstring and all user-facing chart text are written exclusively in Chinese, indicating a fixed language choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
The file contains user-facing natural-language text and comments in Chinese, including the module header and docstrings, without offering a language choice or documenting that the skill is intentionally region-specific. This can violate a language/locale policy when users are not given an opt-in or alternative locale.
The docstring and chart labeling instructions are written in Chinese and indicate a Chinese-localized presentation style, while the file does not provide any opt-in or alternative language choice. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.
This markdown file contains natural-language instructions that effectively force a specific language/locale context, including an explicit requirement for Chinese font handling. Under the policy, locale or language constraints should either be optional, user-selected, or clearly justified as region-specific; that opt-in or justification is not stated here.
The script writes an output image file via plt.savefig(...), which affects the local filesystem. There is no confirmation prompt, print/log message, or explanatory comment/docstring warning the user that running the script will create output_mckinsey_grouped_vbar.png.
This Python file performs a filesystem write by saving an image to output_mckinsey_stack100.png. There is no confirmation prompt, user-facing log/print statement, or explanatory warning in the file indicating that running it will create or overwrite a local file.
The document is written entirely in Chinese and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
No suspicious patterns detected.
