Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only skill for a UI component library, with no executable code or hidden runtime behavior.
Install this as component-library documentation. Developers should still add confirmation and recovery expectations around delete callbacks, and ensure upload endpoints are appropriate before sending sensitive files.
This markdown file documents a destructive delete capability via onRemoteDelete, but the description provides no warning about data loss, irreversibility, or the need for confirmation before deletion. Under the markdown-specific SQP-2 criteria, user-facing documentation should warn when behaviour can affect user data or system integrity.
The example shows api.deleteDept(key) and only reports success afterward, but the surrounding documentation does not warn readers that this operation removes data. For markdown files, examples that demonstrate destructive actions should include clear warnings about their impact on user data.
This markdown section documents upload and removal capabilities, including large-file upload and deletion confirmation, but does not include any user-facing warning that files may be transmitted to remote services or may affect user data/privacy. Under the markdown-specific missing-warning rule, documentation for behaviors affecting user data should disclose such impact clearly.
The examples show request: uploadFile for editor content and image upload, which can transmit user-provided content to a backend, but the surrounding markdown does not warn about privacy or data handling implications. For markdown files, user-impacting networked behavior should be accompanied by a clear warning.
This markdown file uses only Chinese for headings, descriptions, examples, and comments, which imposes a specific language on users without any visible opt-in or justification. Under the policy for natural-language violations, forcing a language or locale without user choice can be a violation unless the regional constraint is documented.
This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
No suspicious patterns detected.
