Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed marketing-simulation prompt pack with live search and Korean output, and I found no hidden execution, persistence, or destructive behavior.
Installers should understand that Pro simulations may send scenario-derived keywords to web/news/trend sources and that reports are designed to be in Korean. Do not enter confidential campaign, product-launch, or competitor-sensitive details unless you are comfortable with those terms being used for live search.
Several agent prompt sections require responses in Korean using directives such as 'Korean.' This imposes a language policy constraint without opt-in, user choice, or documented justification that the skill is region-specific.
The prompt for Consumer Agent 1 ends with a mandatory 'Korean.' instruction. This is a natural-language locale restriction and no surrounding text offers the user a language choice or explains why Korean is required.
The prompt for Consumer Agent 2 requires Korean output. Because the skill does not present this as an optional or justified regional setting, it conflicts with the language/locale policy guidance.
The Marketing Agent prompt specifies Korean-only output. This is a locale restriction expressed in natural language, with no opt-in or clear region-specific justification in the file.
The Expert Agent prompt also mandates Korean output. Repeated hard-coded language requirements across the skill indicate a forced locale policy without user choice.
The skill explicitly instructs live web/news/trend collection and competitor monitoring, but does not tell the user that external network requests may occur or that scenario-derived keywords may be sent to third-party services. This creates a transparency and privacy risk, especially if users provide confidential campaign or product-launch details that are then used in searches.
No suspicious patterns detected.
