Security audit
Security checks for vulnerabilities and agentic risk
This is a single Markdown skill for construction cost estimating with no executable code or hidden access, though users should be careful when exporting sensitive bid or pricing documents.
Before installing, treat any project lists, bid prices, and cost assumptions as sensitive business data. Confirm what will be included before generating Excel, Word, or PDF reports, and choose the export location yourself when your agent creates files.
The trigger list includes broad, high-frequency terms such as 工程预算、工程造价、成本测算 and related generic budgeting phrases, which can cause the skill to activate in contexts where the user did not intend to use this specific tool. Mis-triggering can route unrelated user content into the skill workflow, increasing the chance of inappropriate handling of project or pricing data.
The skill advertises exporting Excel, Word, and PDF outputs but does not state what user data will be written, where files are stored, whether existing files may be overwritten, or whether the user must explicitly confirm export. In a pricing and bidding context, generated documents may contain sensitive commercial figures, project details, and internal cost assumptions, so silent or ambiguous file output creates a real confidentiality and integrity risk.
整份技能说明、触发词、步骤、示例和输出均仅以中文呈现，且没有说明可根据用户偏好切换语言或至少接受其他语言输入。按照语言/区域政策要求，若技能强制单一语言而无用户选择，属于自然语言层面的策略问题。
No suspicious patterns detected.
