Security audit
Security checks for vulnerabilities and agentic risk
This is a text-only OPC community operations advisor with broad activation wording but no hidden execution, credential access, persistence, or data exfiltration behavior.
Before installing, consider whether you want a broad OPC incubator operations assistant to activate on general community, recruitment, event, content, or growth requests. It appears safe, but narrower trigger phrases would reduce accidental activation in a multi-skill setup.
The trigger keywords include broad, common terms such as “招商”, “活动”, “内容”, and “数据”, which can cause the skill to activate in conversations not actually intended for this agent. In a multi-skill environment, this can lead to misrouting, unintended disclosure of community-specific guidance, or interference with more appropriate skills handling the request.
This manifest description presents the skill as a general-purpose 'virtual incubator operations team' covering entrepreneurs' full lifecycle, but it does not specify when the skill should be invoked versus when it should not. In a manifest file, this kind of broad functional description can contribute to ambiguous activation because there are no explicit trigger phrases, scope limits, or exclusion examples.
