Security audit
Security checks for vulnerabilities and agentic risk
This instruction-only skill performs disclosed commercial content and product analysis without executable code, persistence, credential use, or hidden data handling.
Before installing, note that the skill is designed for commercial teardown workflows and defaults much of its output structure to Chinese. For public URLs or current pricing/review claims, it may browse public sources and cite them; it should not request secrets, cookies, tokens, wallets, or private account access.
The README states that the structured summary fields are in Chinese, which imposes a language choice by default. This is a natural-language policy concern because the file does not offer user opt-in, alternatives, or a documented region-specific justification.
The manifest description says to use the skill for analyzing many kinds of inputs such as posts, profiles, product pages, landing pages, app pages, URLs, screenshots, or pasted text, but it does not define a narrow trigger phrase, activation scope, or negative examples. Because this is a manifest file and the description is very broad, it could overlap with many ordinary analysis requests and lead to unintended invocation.
The required output format mandates Chinese section labels such as '对象类型', '分析标题', and '一句话结论', which imposes a specific language on users. There is no indication that the user can choose the output language or that the locale restriction is justified as region-specific.
The example prompt hard-codes Chinese as the interaction/output language ('请用 mixed-mode... 输出要求') without offering a user language choice or documenting that the example is intentionally locale-specific. This can cause unintended language switching, reduce usability, and increase the chance that downstream agents follow the example as a hidden output constraint rather than adapting to user preference.
The skill content is entirely written as a directive in Chinese and does not indicate that the user may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.
The prompt instructions are written to require interaction in Chinese and do not offer an explicit language or locale choice. This can violate language/locale policy when a skill implicitly forces one language without user opt-in or documented justification.
No suspicious patterns detected.
