Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Chinese technology-transfer consulting template package, with expected business-contact sharing guidance but no hidden execution, persistence, or privilege-seeking behavior.
Before using this skill in a real transaction, confirm authorization from the成果方 before sharing contacts or detailed资料包, use NDAs for unpublished technical or commercial materials, and verify legal/tax terms with qualified professionals. Non-Chinese users may also need translation or localization.
The manifest description forces a specific language/locale presentation for all users, and the document does not indicate that the skill is China-specific only or that users may choose another language. Under the policy, a language constraint without user opt-in or clear justification is a natural-language policy violation.
The entire skill body is authored in Chinese and does not provide users with a language or locale choice. Although much of the content is China-oriented, the file does not clearly state that this locale restriction is intentional and justified, so it reads as a default forced language policy.
The SOP operationalizes collecting team contact details, assembling technical/commercial materials, and sending them to external resource parties, but it provides no privacy, consent, confidentiality, minimization, or secure-sharing controls. In a tech-transfer context this can expose personal data, unpublished technical information, or sensitive business documents to unauthorized recipients or over-broad distribution during matching and outreach.
Suspicious Unicode normalization or mixed-script content
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| 成果评价 | 技术尽调四层分析法（自建） | 专利层→技术层→团队层→财务层 | 注：技术尽调/投资方尽调/沙盘推演/投资路演独立Skill文件尚未创建，本V2版基于其框架原理内建于本案例 |
| 市场评估 | `胡田-OPC导师-商业模式分析` | PESTL+SWOT+商业模式画布九宫格 | 9维度各1-10分 |
| 资本匹配 | 投资方尽调框架（自建） | 资本类型×偏好匹配×风险适配 | 注：独立Skill文件待创建 |
| IP运营 | `skill-tech-transfer`（`.skills/skill-tech-transfer/SKILL.md`） | 许可/转让/作价入股三模式 | |
| 回报推演 | 沙盘推演框架（自建） | 多路径+具体数字推演 | 注：独立Skill文件待创建 |
| 路演对接 | 投资路演框架（自建） | One-Pager+问答库 | 注：独立Skill文件待创建 |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| 成果评价 | 技术尽调四层分析法（自建） | 专利层→技术层→团队层→财务层 | 注：技术尽调/投资方尽调/沙盘推演/投资路演独立Skill文件尚未创建，本V2版基于其框架原理内建于本案例 |
| 市场评估 | `胡田-OPC导师-商业模式分析` | PESTL+SWOT+商业模式画布九宫格 | 9维度各1-10分 |
| 资本匹配 | 投资方尽调框架（自建） | 资本类型×偏好匹配×风险适配 | 注：独立Skill文件待创建 |
| IP运营 | `skill-tech-transfer`（`.skills/skill-tech-transfer/SKILL.md`） | 许可/转让/作价入股三模式 | |
| 回报推演 | 沙盘推演框架（自建） | 多路径+具体数字推演 | 注：独立Skill文件待创建 |
| 路演对接 | 投资路演框架（自建） | One-Pager+问答库 | 注：独立Skill文件待创建 |
The file presents all user-facing instructions and descriptions in Chinese only, which can amount to a language/locale policy violation when no opt-in or alternative language is provided. The content does not state that the skill is intentionally limited to Chinese-speaking users or a China-specific compliance context.
This markdown file is entirely presented in Chinese and does not indicate that the user can choose another language or that the template is intentionally limited to a Chinese-speaking or region-specific audience. Under the language/locale policy check, a fixed language without opt-in can be a natural-language policy concern.
This markdown file is entirely written in Chinese and presents the agreement template only in that language, with no indication that users may choose another language or locale. Under the policy for natural-language violations, fixed language behavior without opt-in can be flagged unless the locale constraint is explicitly documented and justified.
This markdown file contains a full skill/template in a single mandated language, with no indication that users may request another language or locale. Under the policy rule for language/locale, forcing one language without opt-in can be a natural-language policy concern.
This markdown file is a natural-language template and all user-facing content is fixed to Chinese. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a policy violation when no justification or alternative is provided.
The entire skill file presents mandatory operating guidance solely in Chinese and does not indicate that users may choose another language or that the locale restriction is intentional and justified. Under SQP-3, forcing a specific language without user opt-in can be a natural-language policy violation.
No suspicious patterns detected.