Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently turns approved card copy into local image files with review checkpoints before upload or publication.
Install this if you want agents to render reviewed social-card packages into local image files. Review generated images yourself before publishing, especially when using external image generation or public URL workflows, and only confirm uploads after checking factual accuracy, branding, and platform compliance.
The operative instructions are entirely in Chinese and target a Chinese platform profile, but the file does not indicate that the language choice is optional or user-selected. Under the language/locale policy, forcing a specific language without opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
This markdown file instructs the agent to produce a 'publish_ready' Xiaohongshu image set and a real PNG output, culminating in assets intended for publication. Although it says to stop before manual confirmation and upload, it does not explicitly warn the user that generated assets may require review for accuracy, branding, or compliance before use.
This manifest lists user needs such as 'turn approved card copy into real PNG or JPG files' and 'render ... card images' but does not define specific trigger phrases, scope boundaries, or exclusion conditions. In a manifest file, this broad natural-language description can make activation ambiguous for requests involving generic image creation or rendering.
No suspicious patterns detected.
