Security audit
Security checks for vulnerabilities and agentic risk
This skill is a Chinese-language self-assessment helper for turning personal capabilities into small paid experiments, with no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Install this if you want a Chinese-oriented workflow for evaluating which personal capabilities might become paid offers. Review the JSON file before passing it to the optional evaluator script, and treat any pricing or regulated-service advice as an experiment requiring your own professional and compliance review.
The skill references local files and a Python script, which implies file-read/code-adjacent capability, but it declares no explicit tool scope or permissions. In practice this can lead to overbroad runtime access or unclear enforcement boundaries, increasing the chance that the skill reads unintended repository files if the host platform defaults are permissive.
The invocation examples include broad phrases like “我能卖什么” and “把技能变产品”, which are common conversational requests and are not tightly scoped to a specific command or narrow context. The file does not provide exclusion conditions or negative examples to clarify when this skill should or should not activate.
The script returns user-facing status strings only in Chinese (for example, "待验证" and "可优先产品化"). This imposes a specific language on output without any user opt-in, configuration, or documented justification, which matches the language/locale policy violation criteria.
The manifest contains a natural-language default prompt in English while the rest of the interface text is in Chinese, and there is no indication that the user can choose their preferred language. This creates a language/locale policy concern because the skill appears to prescribe English interaction without opt-in or justification.
