Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple terminal text-art generator with disclosed behavior and no evidence of hidden access, persistence, or data exfiltration.
Installers should understand that Chinese characters will be converted to pinyin and broad banner requests may route to this skill. Avoid passing text that should be preserved exactly unless pinyin output is acceptable.
The trigger phrases are broad enough to match many generic requests for terminal text styling, which can cause the agent to invoke this skill in situations where the user may have intended a different formatting or rendering tool. This is not a code-execution issue, but it can lead to misrouting, reduced reliability, and unexpected handling of user input.
The skill states that Chinese input is automatically converted to pinyin without user choice, which can alter meaning, names, or branding and produce output the user did not intend. In this skill's context the danger is mainly correctness and user-consent related, not a direct security compromise, but it still creates avoidable integrity and UX risk.
This manifest-like eval file includes prompts and expected behavior that require Chinese-language handling and specifically convert Chinese input to pinyin. Under the natural-language policy rule, this can be a locale/language constraint without any indication of user choice or opt-in.
No suspicious patterns detected.
