Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed Chinese team weekly-report helper that stores weekly report data locally for comparison; the main caution is normal workplace-data retention.
Install this if you are comfortable with the agent keeping weekly report JSON files locally for future comparisons. Avoid feeding confidential employee or project details unless that retention is acceptable, and consider asking the agent to delete or limit stored reports when they are no longer needed.
The skill persistently stores weekly reports under memory/weekly-reports without prominently informing users about retention, scope, or sensitivity of the data. Weekly reports can contain employee names, work activities, project names, and time allocation, so silent retention increases privacy, insider exposure, and data minimization risks.
The trigger phrases are broad enough that ordinary conversation such as '汇总' or '整理' could activate the skill unintentionally. Because the skill reads and writes persistent weekly report data, a misfire could cause unauthorized aggregation, storage changes, or disclosure of team status information without clear user intent.
L003 的触发短语全部为中文，且文档整体只描述中文交互与中文周报生成，没有提供用户语言选择或说明该技能仅面向中文团队。按照语言/区域策略，这类单一语言约束应有明确的选择机制或适用范围说明。
The title and the entire template specify a Chinese-language weekly report format, and there is no indication that users may choose another language. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
