Security audit
Security checks for vulnerabilities and agentic risk
This skill is a simple Chinese-language market-analysis guide using public ClawHub marketplace data, with no executable code or hidden high-impact behavior found.
Before installing, be aware that the documentation is primarily in Chinese and the market recommendations depend on public ClawHub search/explore data, so treat pricing and demand estimates as advisory rather than authoritative.
The natural-language content from the overview onward is presented exclusively in Chinese, which effectively forces a specific language for users reading or invoking the skill documentation. The file does not mention that Chinese is optional, offer alternative languages, or justify a locale-specific constraint.
The ticket assistant advertises activation on generic phrases like '工单' and '创建工单' plus customer screenshots, which are common in ordinary support discussions. In an agent ecosystem with automatic routing, this can cause unintended invocation and downstream actions such as analyzing screenshots or creating tickets without sufficiently explicit user intent.
A quote-reading skill that 'automatically' activates whenever users reference prior messages is scoped too broadly and ambiguously. This can lead to the skill being invoked in normal conversation, increasing the risk of unintended retrieval, misinterpretation of quoted context, or exposure of prior message content beyond what the user clearly requested.
A memory skill triggered by a phrase as broad as '记住 XXX' is risky because users may casually say 'remember' in conversation without intending durable storage. In a memory system handling personal, emotional, or long-term data, accidental invocation can persist sensitive information and create privacy or consent issues.
A skill-trigger system that performs broad automatic intent matching with unified thresholds and priority arbitration lacks clear activation boundaries. In practice, this can route benign conversation into powerful skills unintentionally, potentially causing side effects, data access, or execution in the wrong tool context.
Automatic semantic router selection without clear trigger boundaries can cause unintended model or skill switching based on loosely inferred conversation meaning. In an agent platform, that increases the risk of context leakage across components, inappropriate capability escalation, or execution under a different policy regime than the user expected.
The natural-language description is written as a Chinese-only operational summary for the skill and does not indicate any language choice or opt-in. Under the policy, forcing a specific language or locale without user choice is a natural-language policy concern unless justified as region-specific.
No suspicious patterns detected.
