Security audit
Security checks for vulnerabilities and agentic risk
The skill is coherent for public real-estate research, but it requires broad workspace and memory searches plus persistent raw-data archiving without enough scoping or retention controls.
Install only if you are comfortable with the skill searching prior project records and memory files in the workspace, and with it saving raw public-source materials for reuse. Prefer using it in a dedicated project workspace and review stored raw responses for personal data, cookies, tokens, or excess metadata.
The file’s natural-language content is effectively Chinese-only, including the description, workflow, and operating instructions. This can violate language/locale policy when no opt-in, alternative language path, or explicit region-specific justification is provided.
The manifest describes a real-estate filing-price collection and analysis workflow centered on collecting public housing/project records, standardizing them, and delivering analysis outputs. Line L38 explicitly expands the workflow to generic shell command execution for directory discovery, which is not clearly justified by the stated purpose and introduces a broader capability than simple record retrieval or analysis.
The SOP requires storing raw public notices, HTML pages, and original interface responses locally, but it provides no minimization, retention, or sensitivity checks. Even when sources are public, raw responses can contain personal data, internal identifiers, cookies, tokens, or excess metadata that should not be persistently retained without review, creating unnecessary privacy and data-handling risk.
