Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward AI news briefing helper that searches and summarizes public news sources, with no code execution, credential access, or persistence found.
Install this if you want a Chinese-oriented daily AI news roundup that performs live web searches and fetches public articles. Before relying on it, be aware that fetched pages are external content and the skill does not explicitly document a language option or exact scheduled trigger behavior.
The skill description uses very broad triggers like '生成AI早报', '查看今日AI新闻', and '了解最近AI行业动态', which can overlap with ordinary user requests and cause the skill to activate unexpectedly. This increases the chance of unintentional external browsing and content retrieval when a user may have only wanted a general answer, creating scope and consent issues rather than a direct exploit.
The manifest description specifies the skill as '每日AI早报生成' and all output fields and behavior are described in Chinese, with no indication that users may choose another language. This creates a locale/language policy concern because the skill appears to impose a specific language without user opt-in.
The manifest description says the skill generates a daily AI morning briefing automatically every morning, but it does not specify what exact trigger phrase, schedule source, or context causes activation. This ambiguity can lead to unintended invocation because users or systems cannot tell when the skill should run versus when it should not.
The workflow instructs the agent to use web_search and web_fetch on remote sources, but the markdown does not clearly warn users that external network access will occur. This can mislead users about data flow and trust boundaries, and may cause the agent to retrieve untrusted or prompt-injected content without adequate transparency.
The natural-language description mandates Chinese-language interaction or presentation implicitly, but there is no indication that users can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can conflict with language-choice policy expectations when no opt-in or justification is provided.
The document title, section headings, and descriptions are written in Chinese throughout, while also listing English sources, but it does not state that the skill is China-specific or offer an alternative language option. This can violate language/locale policy when users are not given a choice or clear justification for the enforced language.
No suspicious patterns detected.
