Security audit
Security checks for vulnerabilities and agentic risk
This is a text-only Chinese performance review aid with no executable code or hidden access, but users should avoid pasting unnecessary confidential HR or personal data.
Before installing or using this skill, treat employee performance material as sensitive: share only the minimum needed, redact personal or compensation details when possible, and follow your organization's HR and privacy policies. The artifact itself does not execute code or access data unless the user provides it in the conversation.
The skill metadata and content define a very broad business-performance capability without clear activation boundaries, permitted inputs, or task-scoping constraints. In an enterprise setting, overly broad activation can cause the skill to be invoked in unintended contexts and process sensitive HR or business data without sufficient guardrails.
The skill explicitly asks users to paste business background, data, and documents, but it does not warn against including sensitive employee performance information, PII, compensation data, or confidential HR records. Because performance reviews commonly contain highly sensitive personal and employment data, this omission increases the likelihood of inappropriate disclosure, overcollection, or mishandling of regulated data.
The skill name includes a China/Chinese suffix and the entire user-facing description is written only in Chinese, with no indication that language selection is optional or region-specific. This may violate a language/locale policy if users are implicitly constrained to one language without opt-in or documented justification.
