Security audit

Cb Community Building Strategy

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only community strategy skill with no code execution, API access, persistence, or credential handling.

This skill appears safe to install for planning community-building strategy. Users should treat its market and platform recommendations as business advice to validate against local laws, platform rules, and cultural context before launch.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The file is a markdown skill description, so natural-language policy checks apply. Lines L101-L103 switch to Chinese for a usage scenario and expected output, but the skill does not indicate that multilingual output is optional or user-selected, which can conflict with a language/locale policy requiring user choice.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The manifest sets `"language": "en"`, which indicates a fixed language choice. Under the policy rule, a forced language setting is a finding when the skill does not provide user opt-in, alternatives, or a justification for why English is required.

Static analysis

No suspicious patterns detected.