Security audit
Security checks for vulnerabilities and agentic risk
This is a career and AI business-planning skill that asks for personal context but does not install code, run commands, persist data, or send data elsewhere.
Before installing, users should understand that this skill may ask about employment, skills, education, available project budget, prior earnings, contacts, motivations, and risk tolerance. Share approximate ranges rather than exact financial or identifying details unless needed, and treat the output as planning advice rather than a guarantee of income or investment/business success.
The trigger list is extremely broad and includes common phrases such as '找方向', '如何发展', '不知道做什么', and '人生迷茫', which can match many ordinary conversations unrelated to this skill. This increases the chance of unintended invocation, causing the assistant to enter a specialized data-collection flow and produce career/business advice when the user did not explicitly request this skill.
The skill explicitly instructs the agent to collect detailed personal profile data across employment status, finances, education, network, experience, motivations, and risk tolerance, but provides no privacy notice, minimization guidance, or handling restrictions. In practice, this can lead to oversharing of sensitive personal and potentially financial information, especially because the conversation is designed to build trust over many rounds.
The framework explicitly solicits sensitive personal and financial information, including employment status, income-adjacent financial capacity, education, work history, and relationship networks, but provides no notice about why the data is needed, how it will be handled, whether retention occurs, or whether answering is optional beyond a single narrow prompt. In a career-guidance skill, this broad profiling increases privacy risk, over-collection, and potential downstream misuse or unauthorized exposure of highly identifying user data.
The framework presents all prompts, instructions, and output structure exclusively in Chinese, which can amount to a language policy constraint if the skill is applied generally. There is no statement that the skill is intended only for Chinese-speaking users or that the user may choose another language.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all guidance in Chinese and does not provide any opt-in, alternative language, or justification that the skill/reference is meant only for Chinese-speaking users.
