Security audit
Security checks for vulnerabilities and agentic risk
This is a low-capability markdown-only helper with vague triggers but no evidence of malicious behavior or privileged actions.
Install only if you want a Chinese-language, video-derived helper for these database/Sun-Panel topics. Expect possible accidental activation from generic words like "Sun" or "MIMIC"; there is no evidence here of code execution, credential use, persistence, or data exfiltration.
The trigger string includes very generic terms such as "Sun" and a broad phrase tied to ordinary product discussion, which can cause the skill to activate during unrelated conversations. In an agent environment, unintended activation can route user requests into the wrong skill, causing confused behavior, unexpected instructions, or disclosure of irrelevant tool capabilities.
The activation scenarios are defined with loose conditions like users saying "database-helper" or "Sun," which are too ambiguous to safely distinguish intended use from normal conversation. This increases the chance of accidental invocation, making the skill more dangerous because the content is a loosely merged, video-derived helper rather than a tightly scoped, validated workflow.
The skill metadata and content are presented in Chinese, with no indication that users can choose another language or that the locale is intentionally constrained. This can violate language/locale policy when a skill implicitly forces a language without user opt-in.
The merged secondary skill section repeats the same problem by introducing additional vague triggers such as the skill name variant and the term "MIMIC," which may appear in unrelated medical, research, or database discussions. While this section is somewhat narrower than the primary trigger block, it still expands accidental activation surface and compounds routing ambiguity.
No suspicious patterns detected.
