Security audit
Security checks for vulnerabilities and agentic risk
This skill provides descriptive pricing and finance framework guidance without hidden access, network use, persistence, or transaction authority.
Installers should understand this as an informational pricing framework, not a financial, tax, or legal advisor. The publisher should narrow triggers to pricing-specific use cases and clarify language behavior, but the inspected artifact does not show hidden access, transactions, persistence, or exfiltration.
The README mixes English examples with core descriptive text written in Chinese, but it does not state that the skill is region-specific or offer a language choice. This creates a natural-language policy concern because the skill appears to impose a specific language/locale without user opt-in.
The trigger section is materially broader than the skill’s stated purpose and routes generic personal-finance, tax, invoicing, budgeting, and financial-health requests into a pricing-focused skill. This can cause mis-scoped guidance, unreliable outputs, and inappropriate financial recommendations because users may receive heuristic pricing content for domains that require specialized, context-specific handling.
The trigger keywords are very broad and generic, especially "pricing", "strategy", and "framework", which are common in ordinary user prompts. This can cause the skill to activate unintentionally, hijack unrelated conversations, and route users into this framework when they did not request it, degrading safety and reliability of skill selection.
The requirement 'Clear documentation in English' imposes a specific language policy in natural language. Under the policy rules, forcing a language without user opt-in or a documented justification is a reportable locale/language policy violation.
The file includes a Chinese-language usage scenario and expected output, but does not state that multilingual output is optional or user-selected. This can conflict with a language/locale policy if the skill is expected to avoid forcing a specific language without opt-in.
The manifest sets "language": "en" with no indication that users may choose another language or that the skill is intentionally limited to English for a documented reason. This can violate language/locale policy when a skill imposes a language without opt-in.
No suspicious patterns detected.
