Security audit
Security checks for vulnerabilities and agentic risk
This is a simple Chinese-language relationship-advice skill with no evidence of hidden access, persistence, exfiltration, or destructive behavior.
Before installing, be aware this skill appears intended for Chinese-language relationship guidance and may activate on broad relationship terms; it should not be treated as professional therapy, legal, medical, or safety advice.
The README’s substantive instructions and examples are entirely in Chinese, which effectively forces a specific language for users. Under the policy rule, a language constraint should either be optional for the user or clearly justified as region- or locale-specific.
The skill content is effectively Chinese-only, with no user language negotiation or stated locale constraint. While not a classic security flaw, this can cause misunderstanding of emotionally sensitive advice, incorrect task routing, or exclusion of users who did not intend to interact in Chinese.
The trigger phrases are broad, generic relationship terms like '夫妻关系' and '不知道怎么处理关系', which can cause the skill to activate in many loosely related conversations without clear user intent. In a relationship-advice context, unintended activation can surface sensitive emotional guidance when the user did not request it, increasing privacy, relevance, and trust risks.
The file’s natural-language content, labels, examples, and output strings are entirely in Chinese, and the parsing logic only recognizes Chinese relationship and emotion keywords. There is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context, which creates a locale policy concern.
The manifest uses the description "auto-generated skeleton," which provides no specific activation scope, trigger context, or constraints for when this skill should be used. In a manifest file, such an underspecified description can contribute to ambiguous invocation behavior because it does not distinguish this skill from unrelated requests or define exclusion conditions.
No suspicious patterns detected.
