Security audit
Security checks for vulnerabilities and agentic risk
This skill is a plain Markdown guide for creating Xiaohongshu images, with no hidden code, persistence, or credential access.
Install this if you want Xiaohongshu-focused image prompts and templates. Review prompts before generation, especially if using product photos or business-sensitive content, and specify a different output language if Chinese is not desired.
The example calls hard-code locale: "zh" for image generation without indicating that this should depend on the user's language preference or explicit opt-in. In a multilingual assistant, this can cause unwanted language targeting, incorrect content generation, or privacy/UX issues by inferring or imposing a locale the user did not request.
The markdown repeatedly specifies locale: "zh" for image generation, which imposes a specific language/locale setting. The file does not indicate that this is optional, user-selected, or limited to a documented compliance requirement, so it appears to violate the language/locale choice policy.
This example again fixes the generation locale to zh, reinforcing a mandatory language setting in the skill instructions. Because no alternative or opt-in path is provided, the skill's natural-language guidance constrains locale choice in a way that may conflict with organizational policy.
The wide-format example continues the same pattern of forcing locale: "zh" in the instructions. Across the file, the locale is presented as mandatory rather than as a justified platform-specific default with user awareness.
This markdown file contains instructional content primarily in English but repeatedly embeds Chinese-only titles, hashtags, and category labels as normative examples. Because the skill does not explicitly state that output should be Chinese-only or ask the user to choose a language, it can be read as imposing a locale/language preference without opt-in.
This markdown file contains natural-language guidance centered on Chinese labels, Chinese examples, and Chinese font recommendations, but it does not state that the skill is intentionally region- or locale-specific. Under the language/locale policy rule, forcing a specific language without user opt-in can be a policy concern.
No suspicious patterns detected.
