Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently creates Chinese-language English vocabulary learning posters and does not show hidden execution, credential access, persistence, or destructive behavior.
Install this if you want Chinese-language English vocabulary knowledge-map posters. Be aware that its activation rule is broad and its language is not configurable, so it may be inconvenient in non-Chinese workflows or casual prompts containing English words.
Referenced artifact was not completely inspected
/infographic-prompt.md`、`templates/style-guide.md`、`templates/layout-modes.md`、`references/style-target-care.png`、`examples/care.json`
The activation condition is overly broad: "输入英文单词时使用" can match many normal conversations containing an English word, causing the skill to trigger outside the user's intent. This can hijack unrelated requests, create incorrect outputs, and interfere with other tools or safer instruction paths, especially because the skill enforces a multi-step pipeline once activated.
The skill description hard-codes Chinese-language behavior without user choice or a clear locale restriction. If auto-invoked for users operating in another language, it can produce unexpected language switching, reduce comprehension, and override user preferences, which is especially risky when combined with the broad trigger condition.
This JSON skill content is entirely structured around Chinese explanations, translations, and audience targeting, including a Chinese-only audience field at L004 and Chinese instructional text throughout. Because the file does not offer a language choice or document a justified region-specific constraint, it presents a natural-language locale policy concern.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The instructions require Chinese content and formatting, including Chinese titles and smaller Chinese text, which imposes a specific language/locale. Under the policy, forcing a language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified or optional.
The schema requires every example to include a "chinese" field alongside "english", which embeds a fixed locale/language requirement into the skill data model. For a general knowledge schema, this is a natural-language policy concern because it forces one language choice rather than allowing user selection or documenting a region-specific purpose.
Line L03 states that the filtering stage 'must produce' layout_plan and the surrounding document is written entirely in Chinese, with line L60 also constraining user-facing terminology. This indicates a fixed language/locale expectation without user opt-in, which can violate language policy for general-purpose skills.
The document explicitly requires English to be larger and bold while also requiring Chinese lines in examples, which imposes a fixed bilingual output format. Because the file does not indicate user opt-in or that the skill is limited to a Chinese-language educational context, this is a natural-language locale policy concern.
This JSON content presents meanings, explanations, and audience information in Chinese throughout the file. Under the natural-language policy rule, forcing a specific language without user opt-in can be a locale-policy issue when no alternative language choice or justification is provided.
This JSON skill file is entirely structured for a Chinese-language learning context, including a Chinese-only audience label at L004 and Chinese translations/explanations throughout. Because SQP-3 applies to all file types, this can be treated as a locale/language constraint that is not accompanied by any explicit user choice or justification in the file.
This JSON file contains natural-language strings in Chinese for the "chain" fields, but there is no accompanying indication that the skill is intentionally Chinese-only or that users can opt into this locale. Under the policy for natural-language violations, forcing a specific language without user choice can be a locale-policy issue.
This manifest-style JSON is in scope for policy checks, and it specifies a Chinese audience at L004 while the instructional fields throughout the file present explanations and translations only in Chinese. That can be a language/locale policy concern because the file does not indicate user opt-in, alternative locale support, or a documented region-specific justification.
This JSON skill content presents explanations, translations, and teaching guidance entirely in Chinese, indicating a fixed language/locale assumption. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.
This markdown file contains substantial Chinese-only instructional and evaluative text alongside English, which can effectively force a language/locale on users who may not understand it. The file does not state that the skill is region-specific or provide any opt-in or alternative language choice.