Security audit
Security checks for vulnerabilities and agentic risk
This is a local Chinese daily/weekly report generator with minor documentation ambiguity but no evidence of hidden sending, network access, persistence, or credential use.
Before installing, confirm you are comfortable with a Chinese-language report template and review generated reports before sharing them. Treat any sending or recurring automation as outside the inspected implementation unless separately configured with explicit recipients and confirmation.
The activation description mixes normal report-generation requests with an ambiguous auto-send style phrase, but does not define who sends, when sending occurs, or what confirmation is required. That ambiguity increases the risk of unsolicited report generation or transmission of potentially sensitive internal status updates if the assistant interprets casual user text as authorization.
The activation description mixes normal report-generation requests with an ambiguous auto-send style phrase, but does not define who sends, when sending occurs, or what confirmation is required. That ambiguity increases the risk of unsolicited report generation or transmission of potentially sensitive internal status updates if the assistant interprets casual user text as authorization.
The module docstring is entirely in Chinese and presents the skill as a general-purpose data collector, but it does not offer any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
The README describes the tool entirely in Chinese and presents output structure and usage in a way that implies Chinese-language report generation by default, without offering users a language or locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is documented and justified.
The natural-language content in this skill file is presented only in Chinese, including the description, feature list, usage notes, and parameter explanations. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation when no alternative language option or justification is provided.
The module docstring presents the tool name and usage entirely in Chinese, and the CLI help strings throughout the file follow the same pattern. This can constitute a language/locale policy issue when no user opt-in or alternative language option is provided.
