Security audit
Security checks for vulnerabilities and agentic risk
This is a Chinese operations-planning guide with analytics and tool-integration examples, and I found no hidden execution, persistence, destructive behavior, or credential theft.
Install only if you want a Chinese-language operations-planning assistant. Treat its analytics and Notion examples as templates, not drop-in production code: do not hardcode tokens, send only approved non-sensitive fields to third-party tools, and add privacy notice, consent, retention limits, and access controls before tracking user demographics, behavior, payments, or feedback.
The declared purpose is operations planning, but the analyzed behavior reportedly includes packaging, metadata validation, manifest generation, and archive creation for skills. That mismatch is dangerous because it can conceal supply-chain or filesystem-affecting behavior behind an unrelated business-facing description, reducing user scrutiny and increasing the chance of unauthorized artifact creation or tampering.
The documented trigger conditions are broad enough to match ordinary user discussion of 'operations planning', 'activity planning', or 'product operations', which can cause the skill to activate outside its intended scope. In an agent ecosystem, over-broad activation increases the chance that the skill injects planning workflows, templates, or tool-use behavior into unrelated conversations, creating prompt-scope confusion and unintended execution paths.
The skill appears to have file read/write capabilities without explicitly declaring a tool scope or permissions boundary. Undeclared file access increases the chance that an agent can touch local files beyond what a user expects, weakening least-privilege controls and making misuse harder to audit.
This markdown file contains user-facing natural-language guidance entirely in Chinese, including the description, workflows, examples, and usage tips. Under the policy, forcing a specific language without giving the user a choice or documenting a justified locale constraint is a natural-language policy violation.
The file provides concrete analytics configurations and event tracking for age group, user type, activity identifiers, signup behavior, and other demographic/behavioral data, but it does not mention notice, consent, minimization, retention, or legal basis. In an operations-planning skill focused on community and content-platform growth, this omission can normalize invasive tracking practices and lead users to deploy non-compliant telemetry, especially because older-age segmentation is explicitly included.
The data collection section recommends gathering detailed registration, participation, payment, interaction, and feedback data, which can expose sensitive behavioral patterns and potentially regulated personal data if implemented without safeguards. Because the skill is positioned as actionable operational guidance, readers may directly adopt these collection points without adding transparency, purpose limitation, or security controls.
The example code demonstrates authenticated outbound API use with a bearer token and sends user-supplied project properties to an external service, but it provides no warning about secret handling, data classification, consent, or validation before transmission. In a skill that may be copied by operators into real workflows, this omission can lead to accidental token exposure or unintended exfiltration of sensitive planning data to Notion.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
def create_notion_page(database_id, title, properties):
"""在Notion数据库中创建新页面"""
url = "https://api.notion.com/v1/pages"
headers = {
"Authorization": f"Bearer {NOTION_TOKEN}",
"Content-Type": "application/json",
This line performs an external POST request to Notion using authenticated headers and a JSON payload built from local data. While not malicious by itself, it is a real data egress point; if reused without safeguards, it can transmit sensitive operational plans, budgets, personnel, or internal links to a third-party platform.
"properties": properties }
response = requests.post(url, json=data, headers=headers)
return response.json()
The script's docstrings and all visible console messages are presented in Chinese, and there is no option for users to select another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
All user-facing documentation is presented in Chinese, and the file does not state that other languages are supported or that Chinese is an optional or region-specific default. Under the policy, forcing a specific language without user opt-in can be a natural-language policy issue unless the locale constraint is documented and justified.
The skill content is entirely in Chinese and does not indicate that language selection is optional or that the document is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in can be a natural-language policy concern.
This code performs a file write to the user's skill directory by creating or overwriting skill-info.json. Although the script prints that it saved the file after the write, there is no prior confirmation prompt or warning comment/docstring indicating that running the packaging flow will modify files in place.
This manifest contains user-facing natural-language fields in Chinese, including the display name and compatibility description, but does not state that the skill is intended specifically for Chinese-speaking users or offer any language/locale choice. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue when the locale restriction is undocumented.
No suspicious patterns detected.