Security audit
Security checks for vulnerabilities and agentic risk
This is a simple market-analysis service description with pricing, and I found no hidden execution, credential access, persistence, or destructive behavior.
Before installing, users should understand this appears to be a paid, China-oriented market-analysis skill. Its broad triggers may activate in general trend or market-analysis conversations, so confirm scope and cost before requesting specialized reports.
The trigger phrases include generic terms like '市场分析', '竞品分析', 'market analysis', and especially '趋势', which are broad enough to match many unrelated user requests. Overly broad activation can cause unintended invocation of the skill, leading to incorrect routing, unexpected paid-service promotion, or disclosure of business-analysis framing when the user did not request it.
The visible skill title and descriptive body are presented only in Chinese, while the file otherwise includes bilingual elements in the manifest. This can indicate a language-default policy that does not clearly offer users a choice of response language or locale.
The package name and description explicitly designate the skill as "CN" and include Chinese-language labeling, which suggests a China-specific language/locale constraint. There is no accompanying text indicating that users can choose another language or that the locale restriction is documented as an explicit opt-in behavior.
No suspicious patterns detected.
