Security audit
Security checks for vulnerabilities and agentic risk
This skill is a descriptive e-commerce planning guide with no code execution, network access, credentials, or persistence.
This appears safe to install as a planning aid. Users should still verify current marketplace fees, eligibility rules, local laws, tax, and compliance requirements directly because the skill provides guidance, not professional advice or live market data.
The instruction "Or just describe your product and target market" is not a specific trigger phrase and could match many generic commerce-related conversations. The file does not provide exclusion conditions or boundaries here, so the invocation scope is broader than the earlier, more specific trigger examples.
The manifest sets "language": "en", which indicates a fixed language/locale choice. Under the policy rules, forcing a specific language without user opt-in or a clear region-specific justification is a natural-language policy concern.
Line L14 states that documentation is "English-first," which is a natural-language locale constraint. Because the text does not offer a language choice or explain a region-specific justification, it may conflict with the policy against forcing a specific language without user opt-in.
These lines present a Chinese-language usage scenario and expected output, but the skill does not explicitly state a language-choice policy or that responses should match the user's requested language. This can create ambiguity about whether the skill may switch or force language/locale behavior without user opt-in.
No suspicious patterns detected.
