Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed strategic decision framework with a local scoring helper and no evidence of hidden data access, exfiltration, persistence, or destructive behavior.
Before installing, treat this as a business-strategy advisor that may ask for confidential company context. Use it only with information you are comfortable providing to your agent, and invoke it explicitly if broad trigger phrases could interfere with ordinary planning conversations.
An executable nested in a document or hidden/disguised artifact can evade ordinary extension-based review while still being available to the skill at runtime.
The README defines generic trigger phrases such as '帮我推演一下', '选方向', and '决策推演', then says any trigger phrase in conversation will activate the skill. These phrases overlap with normal strategic discussion and the file provides no negative examples or boundary conditions, making unintended invocation more likely.
The trigger examples are broad, natural-language phrases such as '战略推演' and '选方向' that can plausibly appear in ordinary business conversations. This can cause the skill to activate outside its intended scope, leading to unsolicited strategic guidance, context switching, or accidental use of linked resources/templates when the user did not explicitly request this skill.
The README centers bilingual navigation between Chinese and English and presents the skill in those languages only. While not severe, this can be read as a locale/language constraint without explicitly stating that users may choose another language or that outputs can adapt to user preference.
No suspicious patterns detected.
