Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple public-content search and summarization alias with some usability concerns but no hidden execution, persistence, credential access, or destructive behavior.
Install this only if you want content-search requests to use public web/platform lookup and metadata-based summaries. Prefer explicit invocation such as `/content-summary` to avoid accidental activation from generic summary requests, and verify whether the separate detailed playbook exists in your environment.
The aliases summary and 内容摘要 are highly generic and overlap with ordinary conversational requests, making unintended activation likely. This is dangerous because common user prompts about summarization could invoke external search-and-summarize behavior instead of a local summarization path, expanding data access and tool usage unexpectedly.
Mandating Chinese summaries without user choice can violate user expectations and reduce transparency, especially if the user requested another language or relies on precise wording for safety-sensitive interpretation. While not a direct code-execution issue, it can lead to miscommunication, degraded usability, and incorrect downstream decisions based on untranslated or unexpected output.
The skill allows activation from a broad natural-language request that 'clearly asks for content search, ranking, and summary output,' which can cause unintended routing when a user makes a generic request that happens to match those semantics. In an agent environment, overly loose triggers increase the chance of accidental skill invocation, unexpected browsing/scraping behavior, or bypass of more appropriate user confirmation flows.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
For the full detailed playbook, also see:
- `skills/content-search-summarization/SKILL.md` in this repository
No suspicious patterns detected.