Security audit
Security checks for vulnerabilities and agentic risk
This package is a documentation-only credential-vault description with no executable code, install hooks, credential access, persistence, or hidden behavior.
Before relying on this as an actual password or credential manager, inspect the real implementation and independent security review; this package itself is only documentation and marketing-style claims, not a working vault.
The manifest uses only Chinese naming in the package and author fields, which can indicate a language-specific constraint. Because the manifest does not document that this skill is region-specific or offer any language/locale choice, it may violate the policy against forcing a specific language without user opt-in.
Line L04 requires all branding to use a fixed Chinese naming form and forbids alternatives, but the document does not provide any language or locale opt-in. Under the policy, forced language or locale choices in natural-language instructions can be a violation unless explicitly justified as region-specific.
This SVG presents all user-facing text in Chinese, including headings, capability descriptions, and footer text, with no indication of language choice or opt-in. The policy for natural-language content requires flagging language or locale constraints when the skill forces a specific language without offering the user an alternative.
This file contains user-facing text entirely in Chinese, including the title and subtitle, with no indication that the content is optional, localized, or intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
This SVG contains all user-facing labels and explanatory text in Chinese, including the title, legend, and footnote, with no indication that language selection is optional or region-specific. Under the policy rule for natural-language violations, forcing a specific locale without opt-in is a reportable issue.
SQP-3 applies to all file types and covers language or locale policy violations. This report uses Chinese throughout, but does not state that the skill is China-specific or provide an opt-in or alternative language, which can amount to forcing a specific language on users.
No suspicious patterns detected.
