Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese-language chart export helper with no install scripts, network calls, persistence, or credential access, though users should be careful with pasted HTML or JavaScript.
This skill appears safe to install from the inspected artifacts. When using it, only paste chart HTML/SVG/Canvas code you trust, avoid including secrets or private data in markup, and render untrusted scripts in an isolated browser context.
The label and description are presented only in Chinese, which can impose a specific language on users without any opt-in or documented locale limitation. The file does not state that the skill is intended only for Chinese-speaking users or a China-specific environment.
The skill explicitly accepts user-supplied HTML, SVG, and Canvas JavaScript, but the documentation does not warn that such content may be sensitive or potentially executable. In this context, missing safety guidance can lead users to paste untrusted or confidential markup/script into a rendering workflow, increasing the risk of script execution, data exposure, or unsafe handling in downstream tooling.
The manifest presents user-facing text only in Chinese ("批量导出", "一次输入多个图表，统一配置批量输出") with no indication that users can choose another language or locale. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without explicit opt-in.
The manifest uses Chinese-only natural language in the label and description, which can indicate a language/locale constraint without any opt-in or alternative language option. Under the policy, forcing a specific language without user choice is a natural-language policy concern unless clearly documented as region-specific.
The manifest uses Chinese-only natural-language strings for the label and description. Because this file does not indicate that the skill is region-specific or that users can choose their preferred language, it may violate language/locale policy requirements.
The manifest uses Chinese text for the user-facing label and description, but there is no indication that the skill is intentionally region-specific or that users can opt into this locale. This can violate language/locale policy when a skill imposes a language without explicit justification.
The label and description are written only in Chinese, which can impose a language choice on users without any opt-in or documented locale restriction. The file does not indicate that this skill is intended solely for a Chinese-language or region-specific environment.
The manifest uses Chinese-only natural-language fields for the label and description. Under the language/locale policy rule, this can be a policy concern because it imposes a specific language without any visible opt-in or alternative locale handling.
The template sets lang="zh-CN", which imposes a specific language/locale in the file without any indication that users can opt into another locale. Under the policy rule for natural-language constraints, this is a locale choice embedded in the artifact with no documented justification visible in the file.
The document explicitly sets lang="zh-CN", which is a natural-language locale constraint. In this file there is no accompanying explanation that the skill is region-specific, nor any indication that users can opt into another language or locale.
The template sets the document language to "zh-CN", which is a natural-language/locale choice applied by default. In this file there is no indication that the skill is region-specific or that users can opt into a different language, so this may violate the policy against forcing a specific locale without user choice.
The document sets lang="zh-CN", which hard-codes a specific language/locale in a user-facing template. The file does not offer any user opt-in or explain that the template is intentionally region-specific, so it appears to violate the language/locale policy criterion.
The HTML sets lang="zh-CN", which enforces a specific language/locale in the template. Under the policy rule, a fixed locale should either be optional for the user or clearly justified as region-specific, and this placeholder file provides neither.
The document declares lang="zh-CN", which hard-codes a specific language/locale. For this file, there is no visible natural-language justification that the template is region-specific, nor any indication of user opt-in or locale choice.
The document sets lang="zh-CN", which imposes a specific language/locale in a user-facing template. The file does not indicate that this locale is optional, user-selectable, or required for a region-specific purpose, so it may violate language/locale policy expectations.
The document declares lang="zh-CN", which imposes a specific language/locale on the skill output. The file does not provide any natural-language indication that this locale is optional, user-selected, or required for a region-specific purpose.
No suspicious patterns detected.
