Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward local JSON formatting utility with no network access, persistence, credential handling, or hidden execution behavior found.
Before installing, note that the command-line interface uses Chinese messages and that file reads/writes occur only when you pass file or output arguments. Back up important files before using the output option because it writes the formatted JSON to the chosen path.
The file’s instructional content is written entirely in Chinese and presents itself as the operative guidance for AI agents, without stating that language choice is optional or user-selected. Under the stated policy, forcing a specific language or locale without opt-in is a natural-language policy violation.
The document is explicitly limited to English and Chinese sections and does not indicate that users can choose other languages or locales. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is documented and justified.
The changelog explicitly states 'English first', which is a natural-language locale preference embedded in the skill documentation. The file does provide bilingual content, but it does not state that language ordering is user-selectable or optional, so this can be read as imposing a language preference without opt-in.
The natural-language content in this file is entirely in Chinese, including the description of what the AI agent should read and the skill summary. There is no indication that Chinese is optional, user-selected, or required for a region-specific purpose, which can violate language/locale policy expectations.
This code hardcodes the command description, argument help text, and runtime status/error messages in Chinese only. That creates a language-policy issue because the skill does not provide any user opt-in or alternative locale despite being a general-purpose utility.
