Security audit
Security checks for vulnerabilities and agentic risk
KeyboardHero is a coherent offline typing-training game with local-only progress storage and no evidence of network access, hidden agent instructions, or destructive behavior.
Install this if you want a Chinese-interface offline typing game. Be aware it may trigger on generic typing-practice requests and it stores progress locally in the browser; clearing data removes only its keyforce_ localStorage entries.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
</head>
<body>
<!-- 全局静音开关 -->
<button id="btn-mute" class="mute-btn" title="音效开关">🔊</button>
<!-- ========== 主菜单 ========== -->
The trigger phrases are broad generic terms like '打字训练', 'typing', and 'touch typing', which can overlap with many ordinary user requests and cause the skill to be invoked when the user did not explicitly ask for this specific game. While the skill itself appears offline and non-destructive, unintended invocation can still confuse users, hijack routing from more appropriate skills, or cause unexpected local content to be opened.
The document declares lang="zh-CN", and all visible interface text in this file is presented in Simplified Chinese. That indicates a fixed language/locale experience without any user opt-in, selection mechanism, or explanation that the skill is region-specific.
This file presents its title, gameplay instructions, prompts, and status text entirely in Chinese, while the skill content itself trains English typing. The policy requires avoiding forced language/locale constraints unless the user is given a choice or the restriction is explicitly justified.
The file’s comments and user-facing data strings are written in Chinese, and many displayed labels such as tier names, hero names, tips, and achievements are Chinese-only throughout the exported dataset. This suggests the skill experience is fixed to a specific language/locale without any visible mechanism for user language choice or documented locale limitation.
The file’s natural-language comments and all visible UI strings are written in Chinese, indicating the skill is effectively localized to a single language by default. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.
This JavaScript file contains user-facing natural-language strings and comments indicating the skill is presented entirely in Chinese, including the module title and gameplay instructions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.
The selection screen renders visible labels and instructions such as the title, gameplay tip, and key hint entirely in Chinese. Because these are end-user strings and there is no choice of locale or documented region-specific limitation, the file violates the language/locale policy.
The in-game HUD, buttons, rank criteria, and completion dialog all use Chinese-only text. This is a policy issue because the skill dictates a single language for end-user interaction without offering opt-in or documenting a justified locale restriction.
The README states in Chinese that this is an English touch-typing training game for keyboard beginners, which indicates a fixed language/locale expectation. Under the policy, forcing a specific language without offering user choice or documenting a justified regional constraint is a natural-language policy issue.
The file’s natural-language comments are written entirely in Chinese, which imposes a specific language in the skill artifact without indicating user opt-in or a documented locale-specific purpose. The stated policy requires flagging language or locale constraints when they are forced and not justified.
The file comments and descriptive text are written in Chinese, which indicates a fixed language choice in the skill artifact. Under the policy, language constraints should be optional or clearly justified; no opt-in or region-specific justification is present in this file.
This CSS file contains extensive user-facing natural-language content and comments centered on Chinese, including the title and many labeled UI sections. There is no indication anywhere in the file that users can choose another language or locale, which may conflict with the policy against forcing a specific language without opt-in.
The file header and many user-facing comments/text are written exclusively in Chinese, indicating the skill experience is designed around a fixed language without offering a user language choice. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.
The user-facing banner text says '按 Shift 切到英文', which directs users to switch to English input specifically. This is a natural-language locale/language constraint embedded in the code and does not appear to offer an alternative or explain a justified regional requirement.
No suspicious patterns detected.