Security audit
Security checks for vulnerabilities and agentic risk
This is a plain Markdown business-ideation workflow with no hidden code, persistence, credential access, or destructive behavior.
Before installing, be aware that the skill may activate for broad business brainstorming or market-research requests. Review generated search queries for your target language and locale before running them, especially the X queries that include lang:en.
The query template explicitly forces lang:en, which imposes a specific language/locale choice in the skill content. The file does not offer an alternative language option or explain why English-only filtering is required, so this is a natural-language locale policy issue.
This template again uses lang:en, forcing English-language content for the search. Because the document does not provide opt-in, alternatives, or a documented justification for restricting results to English, it violates the language/locale policy criteria.
The lang:en filter appears here as well, making the locale constraint systematic rather than incidental. The file does not state that this is a region-specific or English-only research tool, so the forced language setting is a policy concern.
The invocation description is excessively broad and overlaps with many common user requests, including general market research, brainstorming, pain points, and 'what should I build' questions. In agent systems that auto-select skills from descriptions, this can lead to unintended routing, causing this skill to capture prompts meant for other domains and potentially initiate unnecessary research, content generation, or follow-on phases.
The trigger at this location includes very broad conditions such as users wanting to explore a market or asking for random ideas, which can match many ordinary brainstorming requests. This can cause the skill to activate when the user did not intend business ideation specifically, steering the conversation into a predefined workflow and increasing the chance of irrelevant or over-privileged tool usage in environments where skills can invoke web search or artifact generation.
Line L85 includes a locale-specific instruction for the 'Indonesian Market' with an example phrase in Indonesian. Because the guide provides a language/locale directive without stating that this should be chosen based on user preference or explicit market targeting input, it can encourage forced locale output contrary to language-choice policy.
No suspicious patterns detected.
