Security audit
Security checks for vulnerabilities and agentic risk
This skill is a commercial publishing and recommendation system that openly promotes related skills, but it makes those promotions automatic and too easy to route into paid follow-on skills.
Install only if you want an OPC-branded commercial publishing system that appends recommendation and pricing material to outputs. Review or disable the automatic follow-up/footer modules, require explicit confirmation before loading another Skill, avoid logging direct user identifiers, and clarify the license and pricing before use.
SKILL.md:248Mandatory Commercial Recommendation and Output Hijacking
The skill uses 'file_read' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
The natural-language content throughout the skill description is presented only in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation.
The skill explicitly recommends logging a user identifier together with timestamp, skill name, and version for traceability. In a broadly distributed skill with bash/read_file/write_file capabilities, this creates unnecessary collection of potentially identifying usage metadata and can enable user tracking, retention without consent, or downstream leakage if logs are exposed.
The Q&A follow-up module is configured to trigger after any answered question or completed report, which makes the recommendation behavior effectively ubiquitous. In a commercialization-focused skill, this creates a built-in dark-pattern style upsell path that can steer users into additional skills without clear opt-in, increasing the risk of manipulative prompting and unintended cross-skill invocation.
The requirement '提供中文/英文双语描述' mandates a specific language policy for skills targeting 虾小宝SkillAtlas. This forces a locale/language constraint in natural-language guidance without indicating user choice, opt-in, or a clearly justified region-specific exception.
The skill's natural-language instructions, examples, and outputs are entirely in Chinese, with no indication that the user may choose another language or locale. Per the policy rule, forcing a single language without opt-in can be a language/locale policy violation unless the constraint is explicitly documented and justified.
The skill embeds cross-skill routing and paid upsell prompts inside what is presented as a technical due-diligence workflow. This can steer users into unrelated or monetized follow-on actions without a clear consent boundary, increasing the risk of manipulative behavior and scope creep in an agent context.
The documented interaction rules treat broad natural-language inputs such as replying with '1' or '换一批' as control commands that load or refresh skills. In an agent skill context, overly generic triggers can be activated during ordinary conversation, causing unintended skill transitions, recommendation churn, or prompt-routing behavior the user did not explicitly intend.
Broad trigger phrases can cause unintended activation of paid, sensitive, or irrelevant skills during normal business conversation. In a recommendation/router system, ambiguous triggers increase the chance of misrouting users into finance, governance, M&A, or commercialization workflows they did not request, which can create privacy, compliance, and transactional risk.
The manifest describes this skill as a commercialization release system focused on standardized release workflows, copyright protection, cross-link recommendation, and pricing strategy. However, this configuration defines and recommends numerous unrelated domains such as game coaching, philosophy/mindset content, gold trading, bill/payment services, and SPAC planning, which materially broadens the skill network beyond the declared release-system purpose.
Generic project-management triggers such as common workflow terms are especially prone to accidental matches because they appear in many ordinary prompts. Given this network's dense cross-linking, an overly broad activation can cascade into adjacent skills and recommendations, making unintended behavior more likely than in an isolated skill.
Line L205 states that the xiaopeng platform requires '提供中英双语', which imposes a language/locale requirement in the template itself. Because the template does not mention user preference, opt-in, or a justified region-specific constraint, this is a natural-language policy concern under the language/locale rule.
The document states channel requirements including '需中英双语' and later requires '提供中文/英文双语description'. This is a language/locale constraint presented as mandatory platform adaptation guidance, but the file does not offer user choice or explain a justified region-specific need for forcing bilingual output.
The skill solicits team background information, which may include personal or sensitive professional data, without giving users any privacy notice, minimization guidance, or handling constraints. In agent workflows, this can normalize overcollection and increase the chance that personal data is stored, reused, or shared inappropriately.
Earlier documentation defines the pyramid as principle verification, parameter comparison, and risk assessment, with the top 'risk conclusion' being the final judgment rather than a risk-identification layer. Saying Step 4 performs risk identification 'according to the four-layer framework' contradicts the structure described above and overstates what the fourth layer represents.
All user-facing instructions, prompts, examples, and output templates in the file are fixed in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-language context. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.
The module docstring says the tool is invoked as python recommend.py <current_skill> [top_k], and the CLI parses top_k at L178. However, both output functions called by the CLI hardcode top_k=3 when invoking recommend at L113 and L133, so the provided CLI argument has no effect. This is a documentation-to-code contradiction rather than a mere omission.
This code file contains user-facing natural-language strings and usage instructions exclusively in Chinese, including the module description and CLI examples. Under the language/locale policy, forcing a specific language without user opt-in can be a policy violation when no alternative or justification is provided.
The script's help text, status messages, and error messages shown to end users are all hard-coded in Chinese. Because the file does not offer a locale choice or explain a necessary regional scope, this appears to enforce one language by default.
The file's natural-language description and all user-facing skill metadata are presented exclusively in Chinese, but the manifest does not state that the skill is China/Chinese-specific or offer any language choice. Under the language/locale policy, forcing a single language without opt-in can be a policy issue unless the locale constraint is explicitly justified.
No suspicious patterns detected.