Security audit
Security checks for vulnerabilities and agentic risk
This prompt-only skill is a coherent Chinese-language money-making research and tracking assistant, with disclosed but privacy-relevant external research and local state persistence.
Install only if you want a Chinese-market focused income-opportunity assistant. Before using it with sensitive business plans or personal income details, decide whether you are comfortable with external platform research and local memory/file retention, and consider asking the agent to confirm before writing income_database.json or storing memory.
The skill metadata and operational content are presented in Chinese and target Chinese-language platforms, but there is no statement that this locale is optional or intentionally region-specific. SQP-3 applies when a skill appears to force a specific language or locale without user opt-in or documented justification.
The skill directs research across multiple third-party platforms, but does not disclose that network access may occur or what queries/data may be sent externally. This can expose user interests, business ideas, or account-linked browsing activity to external services without transparency, increasing privacy and operational risk.
The skill explicitly persists state by updating income_database.json and stored memory, but it does not warn the user that local data will be modified or describe what data is retained. Silent persistence can lead to unintended data retention, overwriting existing files, or accumulation of sensitive financial/planning information without informed consent.
The manifest describes an assistant for discovering money-making opportunities, conducting market research, and generating reports. Line L238 states the skill uses sessions_send as a dashboard substitute, which implies pushing updates to external session/UI channels; that capability is not an obvious requirement of market research or report generation itself.
No suspicious patterns detected.
