Security audit
Security checks for vulnerabilities and agentic risk
This is a simple entertainment skill that generates themed SVG art and classical-style Chinese text, with no hidden code or sensitive access.
Installers should expect this skill to auto-activate on mentions of specific 降龙十八掌 moves and produce stylized Chinese SVG art plus archaic Chinese prose. It does not appear to access private data or make system changes, but users who prefer modern language or fewer automatic activations may want the trigger and style rules narrowed.
The description states that the skill will introduce the move in “古朴文言风格,” which forces a specific linguistic style by default. This is a natural-language policy concern because the file does not offer the user a language or style choice or indicate that this behavior is optional.
The trigger examples include broad phrases like “施展降龙十八掌” and “降龙掌法,” which can match general discussion rather than a clear request to invoke the skill. This can cause unintended activation and irrelevant tool use, though the skill itself is content-generation only and does not access sensitive capabilities.
The activation logic mixes precise move names with broad requests like “展示/介绍/画出降龙十八掌中某一招,” creating ambiguity about when the skill should auto-trigger. In practice this can over-match conversational context and reduce user control, but it is not a high-severity security issue in this entertainment-oriented skill.
The file instructs the skill to output content in “古朴文言风格,” use “文言文/古风汉语,” and “避免现代口语.” This hard-codes a language/register choice instead of offering the user an opt-in or alternative, which violates the stated locale/language policy criteria.
No suspicious patterns detected.
