Security audit
Security checks for vulnerabilities and agentic risk
This skill is a prompt-writing helper for product lifestyle images and does not show hidden data access, network use, persistence, or destructive behavior.
Install this if you want Chinese-oriented ecommerce scene prompt templates for TikTok, Instagram, or Xiaohongshu. Expect Chinese labels and examples, and review generated prompts before using them in an image tool or commercial listing.
The trigger phrase example is very broad and resembles an ordinary user request rather than a clearly scoped skill invocation. This can cause accidental activation or routing ambiguity, leading the agent to apply the skill in contexts where the user did not explicitly intend it, which may degrade reliability and produce unintended commerce-oriented outputs.
All user-facing instructions and examples in the README are presented only in Chinese, with no indication that users may choose another language for interaction. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.
The skill specifies that output includes a Chinese scene description and English AI prompt as a fixed format, which imposes language choices in the user-facing behavior. The file does not state that users may choose another language or opt into this bilingual format, so it may conflict with a language/locale choice policy.
This manifest description explains the skill's purpose but provides no specific activation phrases, context limits, or exclusion conditions. In a manifest file, that lack of trigger specificity can make invocation boundaries ambiguous and increase the chance of unintended matching.
The entire reference file is written primarily in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language or region-specific workflow. Under the policy rule for natural-language constraints, this can constitute an implicit language/locale restriction.
This code hard-codes Chinese display strings such as style names and later presents output labels in Chinese, without offering a language selection or documenting a locale-specific constraint. That creates a natural-language policy issue because the skill effectively forces one language for user-facing output.
The formatted output strings are entirely in Chinese, including headings and field labels, and the script provides no argument or setting to choose another language. For a general-purpose skill, this is a locale-policy violation unless the regional restriction is explicitly documented and justified.
No suspicious patterns detected.
