Security audit
Security checks for vulnerabilities and agentic risk
This skill is a transparent, non-executable assistant for collecting and querying public technology-service institution information, with only minor usability cautions.
Installers should understand that the skill is meant for public-source collection and reporting about technology-service institutions. Review its use of broad Chinese trigger terms if accidental activation would be disruptive, and prefer user-directed collection or updates when maintaining any SQLite state database.
The trigger keywords are very broad domain terms such as '科技服务', '孵化器', and '专精特新', which can plausibly appear in many ordinary conversations. That increases the chance of unintended skill activation, causing the agent to inject specialized collection/query behavior or policy constraints into unrelated user requests.
Mandating Markdown table output for all query results imposes a formatting policy regardless of user preference or accessibility needs. While not a direct security exploit, it can reduce user control and create prompt-routing or policy-conflict issues when a different format is required.
