Security audit
Security checks for vulnerabilities and agentic risk
This Markdown-only skill coherently helps prepare Hong Kong stock prediction-market proposals and includes clear limits against submitting anything unless the user explicitly asks.
Review each generated market title, deadline, and resolution rule before allowing actual Gougoubi submission, because prediction-market creation can have public or financial consequences. The installation itself appears narrowly scoped, and no hidden code execution or data collection was found.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
This copies:
- `skills/hk-stock-to-gougoubi-prediction/SKILL.md`
to:
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
This copies:
- `skills/hk-stock-to-gougoubi-prediction/SKILL.md`
to:
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
ls -la ~/.codex/skills/hk-stock-to-gougoubi-prediction
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
ls -la ~/.codex/skills/hk-stock-to-gougoubi-prediction
The stated target use case is written as a Chinese-only workflow (港股分析 -> 预测题收敛 -> Gougoubi 发布参数) with no indication that users may choose another language or locale. This can violate language/locale policy because the skill appears to assume a fixed language context rather than offering an opt-in or alternative.
The Response Format section mandates Chinese headings and field labels, which imposes a specific language on the skill's output. The file does not indicate that this is optional, user-selected, or limited to a justified region-specific compliance requirement.
No suspicious patterns detected.