Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward document-processing helper with disclosed read, extraction, and conversion guidance, and no evidence of hidden execution, persistence, or data exfiltration.
Installers should treat this as a document-handling skill: use it for files you intend the agent to read, and give explicit instructions before any conversion, export, or file write so originals are not unintentionally changed.
The description says the skill triggers whenever a user asks to analyze documents, extract content, or summarize reports, but it does not define narrower constraints or exclusion conditions. These phrases are common and could cause unintended invocation for general conversation about documents rather than explicit use of this skill.
The trigger section includes broad phrases such as a user asking to 'analyze' or 'summarize' after sending a document, and asking for 'specific information' from a document. Without clearer constraints, these triggers may match many ordinary requests and do not make clear when the skill should not be invoked.
The skill advertises read/write and conversion support for multiple document types without clearly warning that these operations can create or modify files. In an agent setting, ambiguous write capabilities can lead to unintended file creation, overwrites, or silent document transformation if the model invokes the skill without explicit user confirmation.
The workflow explicitly says to summarize for the user in Chinese, which imposes a language policy by default. There is no opt-in, language selection, or stated regional justification for restricting output to Chinese.
No suspicious patterns detected.
