Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent marketing-planning skill that may search the web for missing brand details and create a local HTML report, with no evidence of hidden code, credential use, destructive actions, or persistence beyond the report file.
Install this if you want an automatic Chinese marketing-calendar report generator. Be aware that incomplete brand information may be supplemented with web search, and the generated campaign plan will be saved locally as marketing_calendar_report.html, so avoid entering confidential brand strategy unless that is acceptable.
The instruction to automatically use WebSearch when brand data is incomplete causes external data access without a clear user-facing notice or consent step. This can expose user context or sensitive brand-planning inputs to external services and may also introduce untrusted third-party data into the generated output.
The trigger conditions are broad and include common marketing-related phrases, which can cause the skill to activate in conversations where the user did not explicitly request this specific workflow. Because the skill is also configured to 'not ask, not confirm, directly execute,' unintended activation can lead to unanticipated processing, web searches, and file generation.
The instruction defines the assistant role entirely in Chinese and implicitly requires responses in Chinese, without offering the user a language preference. This can violate language/locale policy when a skill mandates a specific language absent documented justification or opt-in.
The skill instructs creation of a local HTML report file without informing the user in advance. While lower risk than external network access, unexpected file creation can surprise users, clutter the environment, or write potentially sensitive business content into a persistent artifact they did not knowingly request.
The instructions direct the skill to generate and write marketing_calendar_report.html, which is a file-write operation. In this markdown file, there is no warning that a local file will be created or modified, nor any caution about where it will be saved.
No suspicious patterns detected.
