Security audit
Security checks for vulnerabilities and agentic risk
This skill is a scoped CSV-to-HTML visualization helper with no evidence of hidden execution, persistence, credential use, or data exfiltration.
Before using it, review pasted CSV data and remove secrets, personal identifiers, financial records, or confidential business fields that are not needed for the visualization. Expect the skill and generated template defaults to be Chinese-language unless adapted.
The label and description are written only in Chinese, which imposes a specific language on users without indicating any language choice or region-specific constraint. The policy for this category requires flagging language or locale restrictions unless they are optional or clearly justified.
The skill asks users to paste raw CSV data but does not warn that the data may include sensitive personal, financial, or business information. Even though the skill claims to generate a local single-file HTML with no external dependencies, users may still unknowingly submit confidential data into the agent workflow, creating avoidable privacy and data-handling risk.
The manifest uses Chinese-only natural-language fields for the label and description, which can amount to a language/locale constraint without any opt-in or justification. Under the policy, locale-specific language is acceptable only when documented and justified or when the user is given a choice.
The manifest uses Chinese-only natural-language metadata in the label and description fields. Under the policy rule for language/locale, this can be a violation when the skill does not provide user opt-in, alternatives, or justification for being locale-specific.
The manifest contains user-facing text only in Chinese for the label and description, but does not document that the skill is intended for Chinese-speaking users or offer any language choice. This can violate language/locale policy when users are not given an explicit opt-in or justified locale constraint.
The manifest uses Chinese-only natural-language fields for the label and description, which can indicate a language/locale constraint without user opt-in. Under the policy rule, locale-specific language is only acceptable when the skill offers a choice or clearly documents that it is intended for a specific region or audience.
The manifest uses Chinese-only user-facing strings for the label and description, which can impose a specific language on users without offering any language or locale choice. The policy allows locale constraints only when they are documented and justified, which is not present here.
The document sets lang="zh-CN", which imposes a specific language/locale choice in natural-language content. The file does not indicate that this locale is optional, user-selected, or required for a region-specific purpose, so it may violate language/locale policy expectations.
The document explicitly sets lang="zh-CN", which imposes a specific language/locale. Under the policy rule, locale constraints should either be user-selectable or clearly justified as region-specific; this file provides neither.
The document declares lang="zh-CN", which fixes the template to a specific language/locale. Under the policy, locale constraints should either be user-selectable or clearly justified as region-specific; this placeholder file provides neither.
The document sets lang="zh-CN", which imposes a specific language/locale in the skill artifact without any indication of user opt-in or a documented region-specific requirement. The surrounding comments and visible text are also Chinese-only, reinforcing a fixed locale choice rather than an optional or configurable one.
The document sets lang="zh-CN", which hard-codes a specific language/locale. Under the policy rules, forcing a locale without offering user choice or documenting a justified region-specific constraint is a natural-language policy violation.
The HTML document sets lang="zh-CN", which fixes the template to Simplified Chinese locale. Under the policy rule, locale-specific behavior should either be optional for the user or clearly justified as region-specific, and this placeholder file provides neither.
The document sets lang="zh-CN", which hard-codes a specific language/locale in the template. Under the policy, locale restrictions should either be user-selectable or clearly documented as justified; this placeholder file provides neither.
The document sets lang="zh-CN", which hard-codes a specific language/locale. Under the policy, forcing a locale without user opt-in or a clearly documented region-specific justification is a natural-language policy concern.
No suspicious patterns detected.
