Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese self-assessment workflow that asks career evidence, computes scores locally, and provides an optional spreadsheet template without hidden or high-impact behavior.
Install this if you want a Chinese-language, book-style career capability self-assessment. Be mindful that it may ask for specific work examples and payment evidence; avoid sharing sensitive client, employer, or financial details unless you are comfortable including them in the conversation.
The skill instructs the agent to read a local reference file and copy an asset file, which implies file access capability, but it does not declare any explicit tool scope or permissions boundary. This creates ambiguity about what files the agent may access and increases the risk of unintended file reads or asset handling beyond the intended resources if the runtime grants broader defaults.
The trigger phrases are broad and overlap with ordinary coaching, self-evaluation, career planning, and market-value questions, which can cause the skill to activate in contexts the user did not explicitly intend. Over-broad invocation increases the chance of unwanted instruction takeover, misleading framing, or unnecessary collection of personal career and financial information.
The entire assessment content is presented only in Chinese, with no indication that other languages are supported or that Chinese is optional. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The skill’s natural-language interface and instructions are entirely in Chinese, with no indication that the user may choose another language or that the locale restriction is intentional and justified. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
The file presents the skill name and description in Chinese while the default prompt is fixed in English, which can impose a language choice without documenting user preference or locale handling. This may violate language/locale policy expectations when the skill does not explicitly offer a language option or justify the constraint.
This manifest file includes a generic invocation phrase for running the assessment, but it does not define any explicit trigger scope, activation constraints, or negative examples. In a manifest context, the absence of specificity can make it unclear when the skill should activate versus when similar everyday assessment requests should not invoke it.
This code embeds all user-facing output labels and tier descriptions in Chinese, which forces a specific language/locale for anyone using the skill. The policy allows locale constraints only when documented and justified or when the user is given a choice, neither of which is present in this file.
