Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Instagram image-generation guide with no hidden code, local access, or unsafe persistence.
Safe to install for Instagram content generation. Review generated content before publishing, specify your preferred language if not English, and be careful with demographic targeting or confidential brand/customer information.
This manifest-style description lists several specific triggers but then adds a very broad natural-language condition that could overlap with many ordinary requests about social media graphics. It does not provide boundaries or negative examples clarifying when the skill should not activate.
The natural-language examples hard-code locale: "en", which indicates the skill defaults output to a specific language/locale. The file does not state that the user can choose another locale or that English is required for a justified region-specific reason.
This example repeats the English-only locale setting, reinforcing a default language policy that may override user preference. No nearby guidance explains that locale should be chosen based on the user's requested language or market.
The markdown examples set locale: "en", which instructs the skill toward a specific language/locale by default. The file does not indicate that English is optional, user-selectable, or required for a region-specific reason, so this appears to violate the language/locale policy.
This example specifies locale: "en" directly in natural-language guidance. Because the file presents these as recommended templates and prompt examples, the hard-coded locale can steer usage toward English without giving users a language choice.
The example includes locale: "en" as a fixed parameter, which is a natural-language policy concern when no opt-in or alternative locale guidance is provided. There is no stated business or compliance reason for restricting output to English.
This file repeatedly uses locale: "en" in its instructional examples, and this instance continues that pattern. Without an opt-in or documented rationale, the examples impose a specific locale contrary to the stated policy guidance.
The travel example sets locale: "en" directly, which is a language policy issue because the documentation does not offer localization choice or justify an English-only constraint. This can bias downstream usage toward English output.
The example hard-codes locale: "en" in instructional content, and the file gives no indication that users can select another language. That makes the locale restriction appear to be an undocumented policy violation rather than a justified constraint.
This is a markdown file, so SQP-2 applies to omitted warnings about behaviors that could affect privacy or user data. The 'Niche Audience Profiles' section recommends targeting by age and gender lean, but the document does not include any caution about responsible audience segmentation or profiling considerations.
No suspicious patterns detected.
