Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-language Obsidian knowledge-card generator with only an explicit optional file-output feature and no hidden execution behavior.
Install this if you want Chinese-style concept cards for Obsidian. Be aware that broad concept-analysis requests may route into this skill, and only use --file when you want it to create a Markdown file in the current directory.
The skill name, description, examples, and mandatory style rules are all written as hard constraints in Chinese, and there is no indication that users may opt into another language. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
The trigger list includes very broad everyday phrases such as '帮我分析一下这个词' and generic single-word concepts, which can cause the skill to activate when a user did not intend to invoke it. In an agent environment, unintended invocation can override the expected assistant behavior, leading to confusing outputs, policy bypass of the normal routing logic, or accidental execution of optional behaviors like file generation if downstream systems infer parameters automatically.
The skill exposes a '--file' option that writes a markdown file to the current directory, but the user-facing description does not clearly warn that local filesystem state will be modified. This creates a consent and transparency issue: users may invoke the skill expecting only text output and unintentionally cause file creation, which is especially risky in shared or automated environments.
No suspicious patterns detected.
