Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it claims by filling local Word templates, with one unsafe manual debugging command users should avoid.
Install only if you are comfortable running Word automation on local .docx files on Windows. Avoid the documented `taskkill /f /im WINWORD.EXE` debug step unless all Word documents are saved and you intentionally want to close every Word process.
The documentation recommends taskkill /f /im WINWORD.EXE, which forcibly terminates all running Word processes on the system, not just the instance started for this skill. This can cause loss of unsaved user work and disrupt unrelated Word sessions, making it an unsafe operational instruction even though it is framed as a debugging step.
The manifest sets the skill language to "zh-CN", which is a locale-specific constraint expressed in natural language metadata. There is no indication here that users can opt into another language or that the restriction is justified by a region-specific purpose.
No suspicious patterns detected.
