Security audit
Security checks for vulnerabilities and agentic risk
This is a document-only short-video analytics guidance skill with no code, API access, credential handling, persistence, or hidden behavior.
This skill is safe to install for manual short-video analytics review. Be aware that its trigger keywords are somewhat generic, so it may be invoked for general performance or content review requests unless narrowed by the platform or user prompt.
The trigger section lists phrases like "performance review," "content review," and "improve video," which are generic enough to match ordinary user requests outside a narrowly defined skill invocation context. The README does not provide exclusion conditions, negative examples, or contextual constraints to clarify when the skill should or should not activate.
The trigger list includes generic phrases such as "content review" and "improve video," which are broad enough to overlap with everyday user requests and may cause unintended invocation. The file also does not provide exclusion conditions or negative examples to clarify when these triggers should not activate the skill.
The manifest's trigger list includes generic phrases such as "performance review", "content review", and "improve video", which are broad enough to match ordinary user requests outside this skill's intended scope. The file does not provide narrowing context, exclusions, or negative examples to clarify when these triggers should or should not activate the skill.
The checklist explicitly states "English-first documentation," which is a natural-language locale preference. Under the policy, forcing a specific language without user choice or a documented regional justification is a language/locale policy concern.
This file mixes English and Chinese examples, but does not clarify whether the skill adapts language based on user preference or input. In organizations with language or locale policies, implicit multilingual behavior can be a policy concern unless the user is offered a clear language choice or the behavior is documented.
The manifest sets the language to "en", which indicates a fixed language preference without any visible opt-in, alternative locale handling, or documented justification for restricting the skill to English. Under the policy, locale or language constraints should be optional for users or clearly justified as region-specific.
No suspicious patterns detected.
