Security audit
Security checks for vulnerabilities and agentic risk
This is a text-only Chinese AI product-management coaching skill with no code execution or hidden data access found.
Before installing, confirm you are comfortable with a Chinese-language PM coaching workflow and verify the publisher/source if OpenClaw provenance matters to you. The reviewed files do not request credentials, run code, or modify user data beyond normal skill installation.
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file is fully written in Chinese and does not state that the skill is region-specific or that users can opt into Chinese, which can imply a forced language choice.
The README presents the skill persona and all user-facing guidance exclusively in Chinese, which implies a fixed language/locale for interaction. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified.
The manifest description includes very broad trigger terms such as 'AI 产品', '产品设计', and 'PRD', which can match many ordinary conversations and cause the skill to activate outside its intended scope. In a subagent that can internally invoke other skills and steer long design workflows, overscoped triggering increases the risk of inappropriate activation, user confusion, and unintended delegation.
The entire skill specification, including headings, input examples, and output template, is written in Chinese and implicitly directs production of Chinese-language boundary statements. There is no indication that the user may choose another language or that the Chinese-only constraint is required for a region-specific compliance purpose, which makes this a natural-language locale policy issue.
This markdown file presents all instructions, inputs, and outputs exclusively in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in or a documented justification can violate language/locale expectations.
The entire skill specification, including headings, input/output examples, and required response format, is written only in Chinese and provides no indication that language is selectable or optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
The entire skill description, example inputs, and required confirmation prompts are written only in Chinese, including the exact user-facing confirmation text. This indicates the skill expects and produces Chinese-language interaction, but the file does not offer an opt-in language choice or explain a justified region-specific constraint.
The natural-language instructions, examples, and user interaction are entirely in Chinese, and the file does not state that the skill is China-region-specific or that users may choose another language. Per the policy, forcing a specific language without user opt-in can be a locale-policy issue.
No suspicious patterns detected.
