Security audit
Security checks for vulnerabilities and agentic risk
This is a content-writing skill for marketing hooks, with no code execution, credential handling, persistence, or hidden data access.
Installers should know this skill may influence broad marketing-style writing requests and may produce English or Chinese platform-specific examples. Review generated claims and numbers for accuracy, since the framework encourages high-impact hooks and extreme examples.
The skill description contains very broad trigger phrases such as 'make this more engaging' and 'create a title', which can cause the skill to activate for many ordinary writing requests outside its intended scope. This increases the chance of unintended routing or prompt-context injection into unrelated tasks, reducing predictability and potentially overriding more appropriate skills.
The README states 'Language Support: English + Chinese', and the examples throughout the file are mixed English/Chinese, but it does not explicitly say the user can choose their preferred output language. This can create ambiguity around language/locale behavior and may conflict with a policy requiring user choice for language output.
The file includes a platform-specific section for Xiaohongshu, a Chinese social platform, but does not state whether locale, language, or regional adaptation is optional. While not inherently noncompliant, this can create a locale-policy concern if the skill applies these patterns by default without user opt-in or contextual justification.
The file includes a dedicated 'Xiaohongshu Video Script Template' with fixed script text in English for a specific locale/platform context, but it does not indicate that this is optional, user-selected, or region-specific guidance. Under the policy rule, natural-language content that imposes a language or locale context without opt-in can be flagged when no choice or justification is provided.
No suspicious patterns detected.
