Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese home-renovation advice skill with some broad and safety-sensitive reference content, but it does not try to run code, access data, persist, or deceive the agent.
Install only if you want Chinese-language renovation and custom-cabinet advice. Treat it as planning guidance, not professional approval: confirm structural walls, waterproofing, gas, wiring, fire safety, and local property/code rules with qualified professionals before demolition, electrical work, lighting changes, or open-flame DIY projects.
The DIY lamp instructions involve lighting components and heat/electrical sources with inadequate safety controls. Improvised lamp assemblies made from scrap wood, USB light strips, fabric, paper, or bottles can overheat, short, or create fire risk if materials are not rated for electrical use. Since the content frames this as a cheap, easy home project, it may encourage unsafe replication.
The candle-holder instructions describe constructing an open-flame object from found materials without fire-safety precautions. Unstable stones, adhesive failure, nearby combustible décor, or poor heat tolerance can lead to tipping, breakage, or ignition. In a lifestyle/home DIY skill, users may underestimate the danger and treat the project as harmless decoration.
The referenced content is materially unrelated to the skill's declared purpose of custom-cabinet pitfall guidance, instead covering robot-vacuum-friendly renovation advice. This kind of scope mismatch can mislead downstream agents or users, degrade trust in the skill, and cause incorrect retrieval or recommendations when the system assumes the reference corpus is aligned with the manifest.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
# 120㎡通铺大规格木纹砖，没想到效果也这么好
原木风的主色调为白色➕木色白色作为背景色，占比50%作用于墙面，柜子和门墙面以浅色为主，颜色暖暖的，效果不错！门的颜色可以调色跟柜子颜色做对比，尽量做到颜色统一！木纹砖选择的是平面哑光肌肤釉，普通的拖把就可以拖的很干净客厅双眼皮边吊走一圈，下吊25cm，宽30cm，错层4公分，好看还不压层高客厅的开间是3.5米，把通往阳台的推拉门去掉，拗不过家人包了门套，整体空间看起来宽敞又明亮！600×1200的木纹砖，好多邻居来参观都误以为是木地板 ，大家选择木纹砖一定不要选那种只有一个版面的，版面太少看起来不自然，太多看起来太杂，6到8个比较合适！木纹砖原木风对于刚需房非常友好，能让小空间更温馨，而且可以整体降低造价定制柜主色为暖白色，开放格为木色，房门，踢脚线跟墙面颜色一致，视觉统一和谐没有做复杂的背景墙，简单双眼皮边吊走一圈，乳胶漆墙顶通刷家具选择多以实木成品为主，颜色温润有质感绿色沙发长度2.8米，没有要茶几
5头的棉花吊灯，奶呼呼的很好看，水电阶段没有在床头两边留线所以安了免布线的壁灯！1.8×2米的樱桃实木床+藤编元素床头柜窗帘用的奶油色棉麻布+白色十字纹麻料纱砸掉原本的飘窗改绿植角，放上几盆自己喜欢的花花草草，小房间氛围感满满！樱桃木实木床头简单实用，视觉上不会有压抑感靠窗小书柜满足少量置物，床头壁灯营造氛围感
简单双眼皮走一圈+窗帘盒衣柜没有要一门到顶，做的分段式衣柜+同色拉手地面600✖️1200木纹砖通铺
The referenced content is materially unrelated to the skill’s declared purpose of cabinet customization pitfall guidance, instead containing long-form pet balcony/cat furniture design material. This is a true skill-data integrity issue because mismatched reference content can mislead users, degrade model behavior, and cause the agent to provide irrelevant or incorrect advice under a trusted domain-specific skill.
The file content is clearly unrelated to the skill’s declared purpose of cabinet customization guidance and instead covers balcony renovation. This creates a scope-integrity problem: an agent using this reference may retrieve and present irrelevant renovation advice, reducing reliability and potentially causing unsafe or costly user decisions in a home-improvement context.
The referenced file contains bedroom renovation content that does not match the skill’s declared purpose of cabinet customization guidance. This mismatch can mislead downstream agents or users, causing the skill to retrieve irrelevant advice and make incorrect recommendations in a home-improvement context where dimensions, materials, and layout guidance need to be accurate and domain-specific.
This section repeatedly recommends knocking down balcony walls, removing sliding doors, removing insulation walls, changing windows to doors, and integrating balcony space into the interior without any caution about structural integrity, façade rules, fire egress, thermal envelope, drainage, or code compliance. In the context of a renovation-avoidance guide, this is especially dangerous because the material is framed as best-practice advice, increasing the chance users will follow hazardous remodeling steps.
The skill hard-codes a specific regional/brand voice ('西安装修课堂' and a non-AI colloquial style) without user opt-in, which can override user preferences for language, tone, or locale. While not a classic security exploit, it is a genuine policy/control issue because it steers outputs in a way the user did not request and could reduce transparency or create unwanted persuasion/bias in responses.
The usage instructions explicitly require a localized speaking style ('不用 AI 味，用西安装修课堂...口吻') regardless of user choice. In context, this is less dangerous than code execution or data exfiltration, but it still weakens user control and can cause misleading or inappropriately localized advice if the user expects neutral, general guidance.
The reference file is materially unrelated to the skill’s stated purpose of cabinet-customization pitfall guidance. Supplying broad DIY home-hack content increases the chance the agent will answer with off-topic, low-quality, or unsafe improvisational advice instead of domain-appropriate cabinetry guidance. In a home-improvement skill, irrelevant DIY instructions can also introduce accidental safety risk because users may treat them as endorsed recommendations.
This section gives DIY instructions involving puncturing or modifying household items without meaningful safety guidance. Users may copy the steps with sharp tools or improvised materials, creating avoidable risks such as cuts, slips, or misuse of unsuitable items in wet bathroom environments. Because the skill is presented as practical home-improvement guidance, readers may assume these instructions are safe by default.
The wall-mounting advice mentions fixing a metal board with expansion bolts but omits key precautions about drilling location, wall type, load limits, and hidden electrical or plumbing lines. Users following incomplete installation guidance could damage walls, strike utilities, or create a falling-object hazard. In a home-improvement context, omission of these basics is materially unsafe.
The referenced file is materially misaligned with the skill's stated purpose: instead of cabinet customization pitfall guidance, it provides broad household storage hacks. This creates a reliability and integrity problem because the agent may answer users with off-topic or inapplicable advice, reducing trust and potentially causing poor renovation or purchasing decisions in a domain where users expect specialized guidance.
The content encourages wall demolition and layout changes as desirable upgrades before it establishes any safety gate around structural review, permits, building systems, or professional assessment. In a home-remodeling skill, users may treat this as actionable guidance and attempt unsafe demolition affecting load-bearing walls, utilities, ventilation, or fire/life-safety elements.
SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This file presents all guidance exclusively in Chinese and does not provide user opt-in, alternatives, or a documented justification that the skill is intended only for a Chinese-speaking or region-specific audience.
The entire file is written in Chinese and provides no indication that language selection is optional or user-configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
This markdown file contains only Chinese-language instructions and headings, with no indication that users can choose another language or that the content is restricted to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
This markdown file presents all instructions and descriptive content exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into this language. Under the policy, forcing a specific language without user choice is a natural-language policy violation.
This markdown skill content presents all instructions and user-facing text exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That can violate language/locale policy when a skill forces a specific language without user opt-in.
The entire skill content is written only in Chinese and presents user-facing material in a single language with no indication of optional language selection or locale-specific justification. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
This markdown file is entirely written as Chinese-language content and presents the skill behavior/content in a single enforced language with no indication that users may choose another language or opt in to this locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
The entire skill content is written only in Chinese and does not indicate that language selection is optional or that the material is intentionally restricted to a Chinese-speaking or region-specific audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file is entirely written in Chinese and provides no indication that the skill offers a language choice or that the Chinese-only presentation is required for a region-specific purpose. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file contains user-facing natural language exclusively in Chinese, and there is no indication that the skill offers multilingual support, user opt-in, or a documented reason for enforcing a single locale. Under the policy rule for natural-language violations, forcing a specific language without user choice can be a compliance issue.