Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Chinese-language sector analysis helper that writes disclosed reports and may create related notes, with no evidence of deception, code execution, or unrelated data access.
Install this if you want Chinese-language sector rotation reports saved in your workspace. Review the generated report and any IMA notes it creates, especially if your sector interests or prompts are sensitive, and consider asking the agent to confirm before saving reports or creating reminders.
The skill README is entirely written in Chinese and the trigger phrases are specified only in Chinese, which implies a language-specific interaction model. There is no documented user language choice, opt-in, or justification that this skill is intentionally limited to a Chinese-speaking context.
The trigger phrases are broad and map to very common finance questions such as '行业分析' or '哪个板块有机会', which can cause the skill to activate in situations where the user did not explicitly intend this specific workflow. In an agent setting, overbroad activation can lead to incorrect tool selection, unintended downstream skill invocation, or generation of persistent reports without sufficiently specific user consent.
The trigger phrases are overly broad and include common conversational requests such as '哪个板块有机会', which can cause the skill to activate in situations the user may not expect. Because the skill performs analysis and later writes reports or creates notes, accidental activation can lead to unintended processing and side effects rather than just harmless response generation.
The skill explicitly writes output to a workspace path and may create IMA notes, but the user-facing description does not disclose these side effects or indicate when they occur. Hidden persistence and note creation are risky because users may invoke the skill expecting only analysis, while the system silently stores artifacts or generates reminders based on inferred signals.
The README states that the skill writes a Markdown report to a dated file path, but it does not mention any user-visible disclosure, consent flow, or retention expectations. In agent environments, silent persistence of user-derived analysis can create privacy, data handling, and auditability issues, especially if prompts or sensitive investment interests are embedded in report contents or filenames.
No suspicious patterns detected.
