Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed ROI calculator skill with local templates and an optional local script, though users should apply their own legal and financial judgment to outreach and investment recommendations.
Before installing, understand that this skill gives business ROI advice, including outreach and investment examples. Verify input assumptions yourself, treat outputs as estimates rather than financial or legal advice, and apply email consent, opt-out, privacy, platform, and local anti-spam requirements before acting on outreach recommendations.
The title and all operating instructions are written as '使用说明' in Chinese, and the examples consistently assume Chinese-language prompts and responses. There is no indication that language is optional or that the skill is intentionally limited to a Chinese-speaking context, which can violate language/locale choice expectations.
The skill explicitly recommends expanding cold-email volume ('建议扩大发送量至 500 封/周') while presenting only ROI upside, without any warning about consent, privacy, anti-spam laws, or platform policy limits. This can encourage users to operationalize bulk outreach in a non-compliant way, increasing legal, reputational, and account-enforcement risk.
The trigger phrases are very broad business terms such as ROI calculation, whether a collaboration is worth doing, and business cooperation evaluation. This can cause the skill to activate during ordinary conversations that only mention these topics, leading to unintended instruction takeover, confused routing, or application of the skill in contexts where the user did not explicitly request it.
SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. This markdown file presents all instructions, labels, and examples in Chinese, and does not mention that the content is region-specific or provide an alternative language option.
This code file uses Chinese throughout its docstrings, CLI help text, templates, and printed output, while not providing any option to select another language or locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation.
The title, instructions, triggers, output format, and examples are all presented only in Chinese, which can indicate a fixed-language behavior. Under the policy, forcing a specific language without user opt-in is a concern unless the locale limitation is explicitly documented and justified.
The entire document is written exclusively in Chinese and provides no indication that language selection is optional or user-configurable. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.
No suspicious patterns detected.
