Security audit
Security checks for vulnerabilities and agentic risk
This market-intelligence skill is purpose-aligned and mainly writes local reports, with only minor documentation gaps around external services and language expectations.
Before installing, confirm whether you are comfortable configuring third-party data providers and report destinations, keep any API keys out of source control, and verify recipients before enabling email or channel delivery. Expect the current bundled script to generate placeholder local reports rather than perform real market collection.
The README content and usage guidance are presented in Chinese, which effectively forces a specific language for users reading the skill documentation. There is no indication that the skill is region-specific, nor any opt-in or alternative language support.
The skill's descriptive and instructional content is presented in Chinese, but the file does not indicate that this locale is optional, user-selected, or required for a justified region-specific purpose. This can violate language/locale policy when a skill implicitly forces one language without opt-in.
This markdown file states that the skill automatically collects, aggregates, analyzes, and reports market information from multiple platforms, which implies external data-source access. The description does not provide any user-facing warning that queries or related data may be sent to third-party services or APIs.
The configuration example includes an api_key for a data source, indicating the skill uses external services and potentially sensitive credentials. The markdown does not include any caution about storing API keys securely, avoiding committing them to source control, or understanding that external providers will be contacted.
The markdown states that output can be sent to a specified channel or email, which may disclose collected market data or user-selected monitoring targets to external destinations. The description does not include any warning about external transmission, privacy implications, or the need to verify recipients.
The package description includes both English and Chinese text, which can impose a locale/language expectation without any stated user opt-in or alternative. Under the policy for natural-language violations, language constraints should be optional or clearly justified.
No suspicious patterns detected.
