Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward accessibility audit guide that scans project UI files, creates a local report, and only applies narrowly scoped style fixes when requested.
Before installing, understand that the skill may read UI-related project files, generate elderly-audit-report.html, and, if you explicitly use fix mode or approve the prompt, edit style values. Review generated fixes before committing them, especially because some examples mix Web and App checklist items.
The skill description does not prominently disclose that it will write an HTML report file and may modify project files through auto-fix. In an agentic environment, insufficient upfront disclosure of side effects can lead users to trigger file creation or source edits without informed consent, increasing the risk of unwanted workspace changes and trust boundary violations.
The skill description and embedded report template are written as Chinese-only outputs tied to zh-CN, with no indication that users may choose another language. This is a natural-language locale constraint that lacks opt-in or documented justification within the skill instructions.
HTML 报告示例在副标题中写明“项目类型：Web”，但同一示例结果中包含多处 App 专属检查项及结论，如 APP 规范字体、点击区域、首次安装引导等。这与前文“第一步：项目识别”中要求先区分 Web 还是 Mobile App 再执行对应检查的意图相冲突，说明文档示例并未遵循自己声明的执行逻辑。
文档前文明确规定报告应输出为 HTML 文件并保存为 elderly-audit-report.html，但交互示例却写成“已生成报告：elderly-audit-report.md”。这不是单纯信息缺失，而是对技能实际产物类型和路径的直接矛盾，可能误导用户或调用方按错误文件名查找结果。
