Security audit
Security checks for vulnerabilities and agentic risk
This is an offline Shopify store-audit helper that generates checklist-style recommendations and does not access external services or sensitive local data.
Install if you want a template-based Shopify optimization checklist. Treat app recommendations and benchmark numbers as general guidance, verify pricing/current app details yourself, and do not expect it to inspect a live store or pull analytics because it explicitly runs without APIs.
Phrases like 'optimization audit' or 'improvement recommendations' can overlap with many ordinary consulting-style requests unless tightly limited to Shopify store diagnostics. The trigger section does not provide negative examples or stricter scope boundaries to reduce ambiguous activation.
This markdown file defines activation conditions as 'None' and says the skill is 'purely descriptive and always available.' That makes it unclear when the skill should activate versus not activate, increasing the chance of unintended invocation beyond clearly scoped Shopify audit requests.
This code returns reports, checklists, and most recommendation text in Chinese, while also accepting English input in the demo. That creates a language-policy concern because users are not offered a locale choice and may receive output in a forced language without explicit opt-in.
The manifest lists very generic trigger keywords such as "shopify" (L09), "seo" (L13), and "转化率" (L12) without any scope constraints or exclusion conditions. These terms are common in ordinary ecommerce discussions, so the skill could activate in contexts far broader than a specific Shopify store-optimization request.
The manifest sets the skill language to "zh-CN" while also including English trigger terms, but there is no indication that users can choose another language or that the locale restriction is explicitly justified. This creates a natural-language policy concern because the skill appears to enforce a specific locale without user opt-in.
The test suite emphasizes Chinese-language behavior throughout and specifically checks only that English is handled 'gracefully' while requiring a report note about no-API behavior. This suggests the skill may primarily force or assume a Chinese locale without an explicit user choice or documented rationale, which can conflict with language/locale policy expectations.
No suspicious patterns detected.
