Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward report-generation skill with disclosed market-research data gathering and no executable code or persistence.
Install only if you want an agent to perform competitive market research and generate reports. Treat any web search or market-data API use as potentially external, and avoid including non-public strategy, customer lists, confidential pricing, or internal plans unless you explicitly intend that context to be used for research.
The skill explicitly references web search, API access, and distribution of generated reports but does not clearly warn users that external services may be contacted or that data may be sent outbound. In an agent environment, this can lead to unintended disclosure of user-provided business information, competitor lists, market plans, or internal strategy context to third-party services.
The file lists specific trigger keywords as slash commands, but the first usage example activates the skill with the generic natural-language phrase "Generate a competitor analysis report for Tesla" instead of one of those commands. This creates ambiguity about whether invocation is restricted to explicit commands or also responds to common business-language requests, increasing the chance of unintended activation.
The manifest description says the skill supports Markdown, PDF, and PPT export formats, but the skill documentation later advertises Excel and JSON outputs as available formats. That is a semantic mismatch between the declared behavior in the manifest and the broader functionality claimed elsewhere in the skill file.
The note "Use most recent data available (标注 data date)" introduces a Chinese-language requirement in the skill instructions without offering the user a language or locale choice. This can violate language/locale policy because it imposes a non-user-selected language convention in output or workflow guidance.
No suspicious patterns detected.
