Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only personality and team-role assessment skill with disclosed report outputs, and I found no hidden code execution, credential use, exfiltration, or unsafe persistence.
Install only if you are comfortable sharing personality-test answers and team-fit details with the agent running this skill. Treat generated reports as private, review them before sharing with teammates or employers, and delete or redact output files you do not want retained.
The entire skill description and usage guidance are written in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-language audience. Under the stated policy, imposing a specific language without user opt-in is a natural-language policy violation.
The skill generates personal and team assessment reports but does not warn users that the reports may contain sensitive personal data or explain storage/handling expectations. In this context, personality profiling and team-fit analysis can reveal behavioral traits, inferred strengths/weaknesses, and interpersonal risk signals, making silent generation or retention of such reports a meaningful privacy and misuse risk.
The invocation examples are broad and can cause the skill to activate on loosely related requests such as general career or team-building advice, increasing unintended collection and processing of personality-related data. In this skill’s context, that is more dangerous because the outputs explicitly generate persisted assessment reports, which may contain sensitive personal profiling information without a clear consent or scoping boundary.
No suspicious patterns detected.
