Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed multi-source research helper with no bundled code, persistence, or hidden install behavior, though users should treat searches as external queries.
Install only if you want a Chinese-oriented research assistant that may query multiple external search, academic, social, and news platforms. Avoid submitting secrets, confidential project names, personal data, or sensitive research topics unless you are comfortable with those terms being sent to third-party services.
Most of the visible instructions and usage examples are presented only in Chinese, and the skill name includes a Chinese assistant label, which can function as an implicit language constraint. There is no indication that other languages are supported or that the user can choose their preferred language.
The README advertises web, academic, social-media, and news aggregation without disclosing that user queries may be sent to multiple external services. This can create privacy and data-handling risk, especially if users submit sensitive research topics, internal project names, or personal data assuming the interaction is local.
The README presents generic phrases like '研究一下 AI 发展趋势' and '找几篇关于机器学习的论文' as usage examples, but it does not define explicit trigger conditions, constraints, or non-trigger cases. These phrases are broad enough to overlap with ordinary user requests, increasing the risk of unintended invocation.
The skill advertises querying multiple third-party platforms but does not warn users that their prompts, topics, or derived search terms may be sent to external services. Because the skill spans search engines, academic portals, social media, and news platforms, missing privacy disclosure materially increases the risk of exposing sensitive research interests or personal data across many recipients.
The trigger condition is very broad: it activates for general research, information gathering, literature review, and public-opinion analysis without clear boundaries or explicit user consent checks. In a skill that queries many external sources, overly broad invocation increases the chance of unintended activation, unnecessary third-party requests, and accidental transmission of user queries to multiple platforms.
The description and instructions are presented entirely in Chinese and focus on China-specific platforms such as 知网、微博、抖音、央视新闻、新华社 without indicating that users may choose another language or locale. This can be a natural-language policy issue if organizational policy requires offering language or locale choice rather than implicitly enforcing one default.
No suspicious patterns detected.
