Security audit
Security checks for vulnerabilities and agentic risk
This is a straightforward Chinese-language web research skill that tells the agent to search, fetch, and browse the web, with no evidence of hidden execution, persistence, credential theft, or destructive behavior.
Install this if you want a Chinese-first web research helper. Be aware that using it can send search terms, URLs, and task context to external websites or search providers, and its broad triggers may browse the web even when a local answer might have been enough.
The skill explicitly enables proactive searching, browsing, and fetching from the internet but does not warn that user prompts or derived search terms may be sent to third-party services. This creates a privacy and consent issue because users may unknowingly trigger external network access and data sharing with search engines, websites, or browser services.
The trigger conditions are broad enough to activate on many ordinary requests such as '了解', '学习', '查询', or '汇报', which can cause the skill to initiate network access when the user may only want a general answer from existing model knowledge. In a web-browsing skill, overbroad activation increases the chance of unintended external requests, unnecessary data exposure in queries, and surprising behavior outside user expectations.
The instructions require prioritizing Chinese search results with country set to CN and later state '用中文总结呈现' and '使用中文'. This forces a specific language/locale behavior without user opt-in or a documented region-specific justification, which is a natural-language policy violation under the stated rules.
The document prescribes fixed search parameters country: "CN" and search_lang: "zh" as the default approach, which imposes a specific locale and language. There is no indication that users can choose another language/region or that this constraint is limited to a justified region-specific use case.
No suspicious patterns detected.
