Security audit
Security checks for vulnerabilities and agentic risk
The skill does not appear to steal data or alter the system, but it presents template-based and partly random reports as if they were public-data competitor intelligence.
Review this before installing if you expect real competitor monitoring or evidence-based intelligence. Treat it as a Chinese-language framework/report generator unless the publisher adds real data collection, source attribution, and clear mock-data disclosure; verify all business claims independently and avoid entering confidential strategy details unless data handling is clarified.
描述承诺的是输入竞品名称/链接后自动生成竞品分析报告，这通常暗含会依据提供的竞品信息进行实际分析。代码表面上覆盖了定价策略、营销动作、SWOT 和应对策略等模块，和描述主题高度相关；但关键问题在于其分析并不真正基于竞品名称或链接的真实数据。competitor_url 参数只是原样返回，未用于网络访问、抓取或解析。所谓用户评价分析明确写着“模拟评价分析”，且使用 Math.random() 生成正负面分布，因此输出并不代表真实竞品情报。定价和营销分析也主要基于行业预设模板，而非对具体竞品的事实提取。此外，类名和注释中的“监控系统”容易让人理解为持续监测，但代码没有任何监控、调度、存储或触发逻辑，只是一次性报告生成。综上，虽然总体领域一致，但存在实质性的描述与实际行为不符，应判定为 mismatch。
The manifest description and the entire markdown content are presented only in Chinese, which implicitly enforces a specific language for users. Under the stated policy, language constraints should either offer user choice or be clearly documented and justified as locale-specific.
The trigger section says the skill applies whenever a user needs to analyze competitor pricing, marketing actions, or generate a SWOT report, but it does not define specific trigger phrases, exclusions, or limits on when the skill should not activate. This ambiguity could cause unintended invocation for general business-analysis requests that only partially overlap with competitor intelligence.
The file header and user-facing descriptions are exclusively in Chinese, and later user-facing messages and report text are also generated in Chinese. Because the skill does not offer language selection or explain that it is intentionally limited to a Chinese-speaking context, it appears to impose a specific language without user opt-in.
The skill description promises analysis from competitor name or URL and 'public information,' but the implementation does not use the URL or retrieve any external data. This creates a deceptive-output risk: users may trust the report as evidence-based when it is actually generated from static templates, undermining integrity and enabling bad strategic decisions.
The pricing analysis function appears to analyze a specific competitor, but the output is derived almost entirely from industry-level preset relevance values rather than competitor-specific evidence. In this context, that can misrepresent conjecture as intelligence, causing users to act on false claims about a competitor's pricing strategy.
The marketing 'monitoring' logic does not inspect the competitor at all; it only maps generic channels to an industry framework. Because the skill is framed as competitor intelligence, this can produce false assertions about a competitor's channel strategy and mislead downstream business actions.
The code claims user review analysis can be based on real or input data, but actually fabricates outputs using Math.random(). In a competitor-intelligence skill, presenting invented sentiment and review weaknesses as analysis can mislead users into making business decisions on false evidence, which is a security-relevant integrity/deception issue.
This manifest includes English displayName/description variants, but the core user-facing operational content such as category, tags, input descriptions, output descriptions, pricing option names/descriptions, and compliance text is only in Chinese. That effectively imposes a language requirement on users without any explicit opt-in or justification, which fits the locale-policy violation criteria.
The natural-language content of the skill is entirely in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.
This markdown file describes accepting competitor names/links and automatically generating analysis reports, but it does not disclose any privacy or data-handling implications. For markdown files, warnings are expected when the skill's behavior could affect user data or privacy, and URLs or analysis inputs may contain sensitive business information.
No suspicious patterns detected.
