Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed startup-planning workflow with no evidence of hidden access, persistence, destructive behavior, or data exfiltration.
Install only if you are comfortable with a mostly Chinese-language startup planning workflow. Be aware that broad trigger words may invoke it during general startup discussions, but the inspected skill itself only provides planning guidance and a simple local print script.
The skill description switches into Chinese and the remainder of the document is effectively written for Chinese-language use, but it does not offer an opt-in language choice or explain that the skill is intentionally region- or locale-specific. This is a natural-language policy issue because it imposes a language constraint on users without explicit choice.
The manifest description is written in Chinese, and the user-facing workflow/stage names throughout the file are also Chinese, with no indication that users can choose another language. This can amount to a language policy issue when the skill implicitly forces a locale without opt-in or justification.
The trigger uses broad generic keywords such as 'startup', 'founder', and 'entrepreneurship', which can cause the skill to activate during ordinary discussions rather than clear user intent to invoke a structured workflow. In an agent system, overbroad activation increases the risk of unintended routing, prompt interference with unrelated tasks, and accidental exposure of workflow behaviors in contexts where they were not requested.
This Python skill presents its title, stage names, prompts, and guidance entirely in Chinese, including user-facing print output. The file does not offer users any language selection or indicate that the skill is intentionally limited to a Chinese-speaking audience, which makes it a natural-language locale policy concern.
No suspicious patterns detected.
