Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese AI-news briefing workflow that fetches public news sources and can send the finished report to user-configured chat channels.
Install this if you want a Chinese AI-news digest. Before scheduling it or enabling message delivery, verify the destination channel and run it manually once to check that only public news summaries are being sent where you expect.
The description defines the skill as automatically translating and organizing content into Chinese for the user, and later configuration also fixes the language as Chinese. This imposes a language preference without offering user choice or making the locale restriction an explicit opt-in policy.
The skill advertises automatic pushing to Feishu, Telegram, and Discord but does not clearly warn users that content will be transmitted to external services. This can cause unintentional outbound data sharing, especially if generated summaries include sensitive context, internal annotations, or organization-specific configuration details.
The manual trigger phrase is phrased like a normal user request, so the skill can activate when a user merely asks for AI news rather than explicitly consenting to invoke this specific workflow. In context, that matters because the workflow performs multi-site fetching, translation, and may lead to downstream distribution, increasing the chance of unintended actions and tool use.
The template hard-codes Chinese output fields and Chinese prose, including a Chinese title and Chinese-only headline/summary placeholders. The formatting rules also explicitly require headlines to be in Chinese, which is a language policy constraint without any stated user choice or region-specific justification.
The note states that all English-language content is automatically translated to Chinese, which imposes a specific language/locale behavior. This is a natural-language policy concern because the file does not indicate any user choice, opt-in, or justification for forcing Chinese output.
No suspicious patterns detected.
